947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013 | Triage

Sharing

General

Target

947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013
Size

58KB
Sample

240505-rpgfkscd81
MD5

8ace9bbfe7e0baad5972d722b33654f5
SHA1

f91a7e9e59370b31cc8a77c6e2bda50844304a85
SHA256

947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013
SHA512

a79fdfaff680fd0aca3a0181412d956fb2aa3d35f64dc63960955b83d5bedf0a9cdd0daaa8dd9a02232a04f8176e864b173e786128a2ac6fd4776b8d496c59ad
SSDEEP

1536:PqsaYzMXqtGNttyUn01Q78a4RVvOnl6vAOxJ0lM:PqsaY46tGNttyJQ7KRVGlIAOxJV

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013
- Size
  
  58KB
- MD5
  
  8ace9bbfe7e0baad5972d722b33654f5
- SHA1
  
  f91a7e9e59370b31cc8a77c6e2bda50844304a85
- SHA256
  
  947a23347e9997e497158757e994d8311d4b7a75fcf9731cd9c3640e92758013
- SHA512
  
  a79fdfaff680fd0aca3a0181412d956fb2aa3d35f64dc63960955b83d5bedf0a9cdd0daaa8dd9a02232a04f8176e864b173e786128a2ac6fd4776b8d496c59ad
- SSDEEP
  
  1536:PqsaYzMXqtGNttyUn01Q78a4RVvOnl6vAOxJ0lM:PqsaY46tGNttyJQ7KRVGlIAOxJV
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2