4ab39abb36148d3ff921833c0d03ed1c7a8116c1a8993210bcfe1565f558107d | Triage

Sharing

General

Target

4ab39abb36148d3ff921833c0d03ed1c7a8116c1a8993210bcfe1565f558107d.exe
Size

126KB
Sample

240522-bxxvjaga96
MD5

6182f0d38783485a9ead962a6869327a
SHA1

965a5be418baa9372688838aa4052a20e5ab4631
SHA256

4ab39abb36148d3ff921833c0d03ed1c7a8116c1a8993210bcfe1565f558107d
SHA512

04235000d610d189ed73b36e9cfd2a359e9885335e96ffa0276b1a0babd001f8a653e80c0f37b6fc428d97110b19cb2b19149b45eb02193e8b8e0b317e8279c4
SSDEEP

3072:Z8ra+p+6/mf21inVtQ1OUpdkT+clARIw06c:bcq21YQ1gCi

Score

8^/10

evasion spyware stealer

Malware Config

Targets

- Target
  
  4ab39abb36148d3ff921833c0d03ed1c7a8116c1a8993210bcfe1565f558107d.exe
- Size
  
  126KB
- MD5
  
  6182f0d38783485a9ead962a6869327a
- SHA1
  
  965a5be418baa9372688838aa4052a20e5ab4631
- SHA256
  
  4ab39abb36148d3ff921833c0d03ed1c7a8116c1a8993210bcfe1565f558107d
- SHA512
  
  04235000d610d189ed73b36e9cfd2a359e9885335e96ffa0276b1a0babd001f8a653e80c0f37b6fc428d97110b19cb2b19149b45eb02193e8b8e0b317e8279c4
- SSDEEP
  
  3072:Z8ra+p+6/mf21inVtQ1OUpdkT+clARIw06c:bcq21YQ1gCi
Score

8^/10

evasion spyware stealer
- Modifies Windows Firewall
  evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywarestealer

behavioral2

evasionspywarestealer