e9990a46709c1333f531573214ec857d38cca122ef2dc88105f2db863f3ae858 | Triage

Sharing

General

Target

e9990a46709c1333f531573214ec857d38cca122ef2dc88105f2db863f3ae858
Size

4.1MB
Sample

240523-ez8lladg65
MD5

e9884c730f4013897fa3f106366eabcf
SHA1

ad3c7bb68a30e0ef1b448a7b46bd2fa4ade2dc09
SHA256

e9990a46709c1333f531573214ec857d38cca122ef2dc88105f2db863f3ae858
SHA512

17aa786eef97fc75ee2a238ba26b93ce34ba12696c324ac3a9a0aebe675e30e944a1742cbcf67b267cfcd27e85e1320e7e5f5315d00fbff3c79f611c2f3eb836
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp4bVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  e9990a46709c1333f531573214ec857d38cca122ef2dc88105f2db863f3ae858
- Size
  
  4.1MB
- MD5
  
  e9884c730f4013897fa3f106366eabcf
- SHA1
  
  ad3c7bb68a30e0ef1b448a7b46bd2fa4ade2dc09
- SHA256
  
  e9990a46709c1333f531573214ec857d38cca122ef2dc88105f2db863f3ae858
- SHA512
  
  17aa786eef97fc75ee2a238ba26b93ce34ba12696c324ac3a9a0aebe675e30e944a1742cbcf67b267cfcd27e85e1320e7e5f5315d00fbff3c79f611c2f3eb836
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBDB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUp4bVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer