d2c45884a1e6e5fbf9db65f32230785bc6625e32a900176d3c8b7bf32e5fdad9 | Triage

Sharing

General

Target

17052024_0128_16052024_signed BOL # A224822.zip
Size

704KB
Sample

240517-bvxfzsbc25
MD5

7d4b61f35ab26b082b53c7cf5edc111d
SHA1

ec170f11c12506bc813fd8ede407be4fffff3c65
SHA256

d2c45884a1e6e5fbf9db65f32230785bc6625e32a900176d3c8b7bf32e5fdad9
SHA512

89d5e636db1baf40b6553fbf428c77c2c2f8eda4c53af7d3607a6acde731e35c2565525f0b1fbddaa541d879427726609f057d03789f99cdf9b6aa04db3b65c9
SSDEEP

12288:SCvpeuqIWSfPugwWqyD+QanXjMsls7SX/jzQLeMzw1wVBOtCi7yHpfJzZj2JrT5x:Bp84PjYyD+XlC7SXrzA13OIWyHFJzZj8

Score

8^/10

execution spyware stealer

Malware Config

Targets

- Target
  
  signed BOL # A224822.exe
- Size
  
  735KB
- MD5
  
  fa464b88b8d056baa452abd50de4d9cc
- SHA1
  
  5e3809c4b465eeb16e61b531ba82fb890cb45d3e
- SHA256
  
  27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63
- SHA512
  
  2363a0066c141c61e761c7e28b69ebdbf5ee1d33f09ce618b7567ce25e0c858b679ba65c3f4d4b078f30c72f5a55f6aa734840dbe8caf1933469a74c3c710572
- SSDEEP
  
  12288:r0pei36RgGQmndBMAygXmTzwLkp7VX3ypdfJzZT2JzT5KWyGuF6QjH0:Ypp36yGBrzXyikZBypxJzZT2f5ynIeH
Score

8^/10

execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

executionspywarestealer