02cff7e352a7c94505a1d1c73425ec9968637b9010c8c017dc70f7d6a78a3a45 | Triage

Sharing

General

Target

02cff7e352a7c94505a1d1c73425ec9968637b9010c8c017dc70f7d6a78a3a45
Size

577KB
Sample

240523-mch2esch9v
MD5

9b73ea744610add358a523c48b536d6d
SHA1

38d35606d7b18b9f9ec4e4bfac20b523ecc1ed88
SHA256

02cff7e352a7c94505a1d1c73425ec9968637b9010c8c017dc70f7d6a78a3a45
SHA512

aa6b8405c175a2cf9be163d8f282894498f2e8ddffde0caa59c0ad2b357582fd21454f1b742d2169e1d326576e08ed8869de861f549cc0fd8c1e4c42fbe6b3eb
SSDEEP

6144:O+aX3cE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:O+an7a3iwbihym2g7XO3LWUQfh4Co

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  02cff7e352a7c94505a1d1c73425ec9968637b9010c8c017dc70f7d6a78a3a45
- Size
  
  577KB
- MD5
  
  9b73ea744610add358a523c48b536d6d
- SHA1
  
  38d35606d7b18b9f9ec4e4bfac20b523ecc1ed88
- SHA256
  
  02cff7e352a7c94505a1d1c73425ec9968637b9010c8c017dc70f7d6a78a3a45
- SHA512
  
  aa6b8405c175a2cf9be163d8f282894498f2e8ddffde0caa59c0ad2b357582fd21454f1b742d2169e1d326576e08ed8869de861f549cc0fd8c1e4c42fbe6b3eb
- SSDEEP
  
  6144:O+aX3cE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQL:O+an7a3iwbihym2g7XO3LWUQfh4Co
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2