f39b1a7b3dfe4a04e8ce9c39f890c6e270bf6ca3faa5ae4335b46c4bb3ae4fef | Triage

Sharing

General

Target

f39b1a7b3dfe4a04e8ce9c39f890c6e270bf6ca3faa5ae4335b46c4bb3ae4fef
Size

393KB
Sample

240523-mcfajach8z
MD5

9e63e73f4ea770b5815adc2a7ee99ebc
SHA1

07a84192aae8275297fd16888fe23cf7b28f520e
SHA256

f39b1a7b3dfe4a04e8ce9c39f890c6e270bf6ca3faa5ae4335b46c4bb3ae4fef
SHA512

906fbcf1d5eadd8dedfb1db7f592537840ddcf4da1db697344cc79f05c8eea2098a8cb8240f473f38f4d51dcf6b9a2548ca6671b309e0584d13e578fb74c552e
SSDEEP

6144:O+aX3RP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1moW:O+aiahVy41

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  f39b1a7b3dfe4a04e8ce9c39f890c6e270bf6ca3faa5ae4335b46c4bb3ae4fef
- Size
  
  393KB
- MD5
  
  9e63e73f4ea770b5815adc2a7ee99ebc
- SHA1
  
  07a84192aae8275297fd16888fe23cf7b28f520e
- SHA256
  
  f39b1a7b3dfe4a04e8ce9c39f890c6e270bf6ca3faa5ae4335b46c4bb3ae4fef
- SHA512
  
  906fbcf1d5eadd8dedfb1db7f592537840ddcf4da1db697344cc79f05c8eea2098a8cb8240f473f38f4d51dcf6b9a2548ca6671b309e0584d13e578fb74c552e
- SSDEEP
  
  6144:O+aX3RP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1moW:O+aiahVy41
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2