04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot
Size

886KB
Sample

240522-rwdm9see4w
MD5

24746fdccccce4b955e650760f0b1ffd
SHA1

fffec1f8109f52d5360dac1ee73b1ddcd9f11c45
SHA256

04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884
SHA512

2e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d
SSDEEP

24576:AOf6bQl8CqETla+mf8qxh0WbS/fu0tY66Lv54SX:AOfsCBlakutbS/fuZ66L+K

Score

9^/10

evasion spyware stealer

Malware Config

Targets

- Target
  
  2024-05-22_24746fdccccce4b955e650760f0b1ffd_mafia_qakbot
- Size
  
  886KB
- MD5
  
  24746fdccccce4b955e650760f0b1ffd
- SHA1
  
  fffec1f8109f52d5360dac1ee73b1ddcd9f11c45
- SHA256
  
  04f68ad08927b21f3ee4b7c37c3356220672ce24ac92b33cd068582ab396e884
- SHA512
  
  2e7bb5111277ad4a453991abc8791587915fc83b845af16379f556509ca88b30bfc38b98046087ea13dfb7c4b2a774f76ed99ee05aca04fd9cc1d50adf2e3c4d
- SSDEEP
  
  24576:AOf6bQl8CqETla+mf8qxh0WbS/fu0tY66Lv54SX:AOfsCBlakutbS/fuZ66L+K
Score

9^/10

evasion spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywarestealer

behavioral2

evasionspywarestealer