2851717dd520fe59588cdce45661e66cc07120564ef9433c6589bc53f11357c4 | Triage

Sharing

General

Target

2851717dd520fe59588cdce45661e66cc07120564ef9433c6589bc53f11357c4
Size

237KB
Sample

240517-ykbg4afh2y
MD5

86f350dabaca456322a4cf098469e071
SHA1

98a19e7e4f24cc65e3cc13415f076ca3f433b66e
SHA256

2851717dd520fe59588cdce45661e66cc07120564ef9433c6589bc53f11357c4
SHA512

c9bf139a5478b7b54ce85f676ae9004acce5bdb54da1ac6b21fb16e2e361fedf89639714c291768fbcdea003594912bd7f5e0ee7951e16947863903c7013af44
SSDEEP

3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hTx:GR5IuMQoseGk7RZBGxAycKpSPX2pUb

Score

10^/10

evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  2851717dd520fe59588cdce45661e66cc07120564ef9433c6589bc53f11357c4
- Size
  
  237KB
- MD5
  
  86f350dabaca456322a4cf098469e071
- SHA1
  
  98a19e7e4f24cc65e3cc13415f076ca3f433b66e
- SHA256
  
  2851717dd520fe59588cdce45661e66cc07120564ef9433c6589bc53f11357c4
- SHA512
  
  c9bf139a5478b7b54ce85f676ae9004acce5bdb54da1ac6b21fb16e2e361fedf89639714c291768fbcdea003594912bd7f5e0ee7951e16947863903c7013af44
- SSDEEP
  
  3072:hsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwR1l9B4hTx:GR5IuMQoseGk7RZBGxAycKpSPX2pUb
Score

10^/10

evasion persistence spyware stealer
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistencespywarestealer