b3f3c5352cd2012d74370973a9aced9be5499c8861955ef6c35e1e2d959ae4b3 | Triage

Sharing

General

Target

b3f3c5352cd2012d74370973a9aced9be5499c8861955ef6c35e1e2d959ae4b3
Size

2.8MB
Sample

240522-18cq6sah81
MD5

ba333cc45bd15adf337d7b6694f7333b
SHA1

4a5ded9188753aa3aee0a2b86644ba180d9bf1f5
SHA256

b3f3c5352cd2012d74370973a9aced9be5499c8861955ef6c35e1e2d959ae4b3
SHA512

61127fcf5cb0a5f7818455f38737461047a4b24d80b1d35649821a98e9693bc88c60f1cdff10874c5a62cfba0d97c21e03cd038431cc76620351e83bbb9ff9d8
SSDEEP

49152:Xd46gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:Xdld1XdhBiiMa7

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  b3f3c5352cd2012d74370973a9aced9be5499c8861955ef6c35e1e2d959ae4b3
- Size
  
  2.8MB
- MD5
  
  ba333cc45bd15adf337d7b6694f7333b
- SHA1
  
  4a5ded9188753aa3aee0a2b86644ba180d9bf1f5
- SHA256
  
  b3f3c5352cd2012d74370973a9aced9be5499c8861955ef6c35e1e2d959ae4b3
- SHA512
  
  61127fcf5cb0a5f7818455f38737461047a4b24d80b1d35649821a98e9693bc88c60f1cdff10874c5a62cfba0d97c21e03cd038431cc76620351e83bbb9ff9d8
- SSDEEP
  
  49152:Xd46gLKJuMarhVnMFwTH8/giBiBcbk4ZxZ2DqFeVMhuxcPh:Xdld1XdhBiiMa7
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2