89ab19f18cbc4be6a719ba3141c335556879409389163b0f8e4b25f766576478 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89ab19f18cbc4be6a719ba3141c335556879409389163b0f8e4b25f766576478
Size

2.6MB
Sample

240505-k8m9xagg48
MD5

0aa82ab81b74d8a30c3e8b279d3a3f4b
SHA1

4cdb4a227c7ca8664f394da0a43be54d1c6caf38
SHA256

89ab19f18cbc4be6a719ba3141c335556879409389163b0f8e4b25f766576478
SHA512

6c30c36cf7a6b2bd78b5c5b93f1700f9ca9bb986de6e27aecc8f1178d663e873d6f7c35c0c24696601cc0d9f85b26e76f64ac22747b0f53dba2a0865ce497e5d
SSDEEP

49152:4gbOY8k5vmIoSTNcZJEevSlYfBznlaK3aEpXhEQTZ1lsc07PhAPk2ltBMCfyWySd:jbvfoKK7yYfBBN392hAPzNNx

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  89ab19f18cbc4be6a719ba3141c335556879409389163b0f8e4b25f766576478
- Size
  
  2.6MB
- MD5
  
  0aa82ab81b74d8a30c3e8b279d3a3f4b
- SHA1
  
  4cdb4a227c7ca8664f394da0a43be54d1c6caf38
- SHA256
  
  89ab19f18cbc4be6a719ba3141c335556879409389163b0f8e4b25f766576478
- SHA512
  
  6c30c36cf7a6b2bd78b5c5b93f1700f9ca9bb986de6e27aecc8f1178d663e873d6f7c35c0c24696601cc0d9f85b26e76f64ac22747b0f53dba2a0865ce497e5d
- SSDEEP
  
  49152:4gbOY8k5vmIoSTNcZJEevSlYfBznlaK3aEpXhEQTZ1lsc07PhAPk2ltBMCfyWySd:jbvfoKK7yYfBBN392hAPzNNx
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2