598b4b21f5d410c30eaf93c2d58949e2c58f4dd40919ba8781848816128488b2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

598b4b21f5d410c30eaf93c2d58949e2c58f4dd40919ba8781848816128488b2
Size

3.1MB
Sample

240510-1la9tsbc8s
MD5

46f8f144a2d206768a06d0849f2cdd2c
SHA1

e0f70f44981ce738817f85b8e9992aedf34c1b2b
SHA256

598b4b21f5d410c30eaf93c2d58949e2c58f4dd40919ba8781848816128488b2
SHA512

13c9b9d4ab90642756a569156d39b8c9645cd037641ac91beda627e0f9c67e7e4f3443aa46f2969941f7eb985bbca035e2f8396d0df8f20ee7f0021728e85ea1
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp9bVz8eLFc

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  598b4b21f5d410c30eaf93c2d58949e2c58f4dd40919ba8781848816128488b2
- Size
  
  3.1MB
- MD5
  
  46f8f144a2d206768a06d0849f2cdd2c
- SHA1
  
  e0f70f44981ce738817f85b8e9992aedf34c1b2b
- SHA256
  
  598b4b21f5d410c30eaf93c2d58949e2c58f4dd40919ba8781848816128488b2
- SHA512
  
  13c9b9d4ab90642756a569156d39b8c9645cd037641ac91beda627e0f9c67e7e4f3443aa46f2969941f7eb985bbca035e2f8396d0df8f20ee7f0021728e85ea1
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8b6LNXJqI:sxX7QnxrloE5dpUp9bVz8eLFc
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer