f087d51b37620a673c0a60e58551eb1e181eeba8870a7857faf00c60b734756e | Triage

Sharing

General

Target

81b72f5f7a970eab42a0af1e66628a20e191e9f0d8d4f4e6524eed14bf98087a.zip
Size

12.0MB
Sample

240502-je527acd81
MD5

f73b824d5c8fe3b89f4f2b0c7e5eda64
SHA1

d160b707116e6ee048ff415b6e06135571dd6fed
SHA256

f087d51b37620a673c0a60e58551eb1e181eeba8870a7857faf00c60b734756e
SHA512

2dcb932d1d7c7cc794d4500a141219235f01353424473ed5f1c90ffcdf82c7a316fa9eedd4a209393fedc4b5fc8467f353234d567913c63d66239b3eece6d1c7
SSDEEP

196608:LRxKpL+f973WfJiDly84b+o6TCG7/OCwCJLpo34oAGDGxPRgs2hI9Bsct:PK9BJiM84b+dTCGitgpLowp99Brt

Score

9^/10

pyinstaller ransomware spyware stealer

Malware Config

Targets

- Target
  
  81b72f5f7a970eab42a0af1e66628a20e191e9f0d8d4f4e6524eed14bf98087a
- Size
  
  12.2MB
- MD5
  
  b1df8228b3ecc57ee7a69578294b1a24
- SHA1
  
  43c7a6de494e72cd5b7c5fe6af58923927a6f635
- SHA256
  
  81b72f5f7a970eab42a0af1e66628a20e191e9f0d8d4f4e6524eed14bf98087a
- SHA512
  
  a70ed6be89446afb3ae58938a8ec5066d00577375548ef585da655c8f49db05477df6ad2746dde1ba4fcab59e88a81bc3b10579e65fbc9d5ee74ba308c5eccfc
- SSDEEP
  
  393216:QEkist1+TtIiFq8uARuAssrfVHfvCMI6cC:Qrt1QtI18uA8sz9n5b
Score

9^/10

ransomware spyware stealer
- Renames multiple (340) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

ransomwarespywarestealer