29b6cf1a4baf2a73f50fe0d9bfbf8340fc8fa894c175491659c0c1fb68054b9a | Triage

Sharing

General

Target

29b6cf1a4baf2a73f50fe0d9bfbf8340fc8fa894c175491659c0c1fb68054b9a
Size

1.1MB
Sample

240523-nejamseb71
MD5

49cf41b3b9ef6fe2ad37a7b876a1a1f3
SHA1

7e2806720f8bdd6fc84093b302e7f10afe0ff174
SHA256

29b6cf1a4baf2a73f50fe0d9bfbf8340fc8fa894c175491659c0c1fb68054b9a
SHA512

7b052075f95d1ab61fd743fa26504025c3622d35085c3d912d7f1748e07a48a1b1966a70b94205687871f3a892a5965b00ddf1dcf881dfa075495cbda6d37967
SSDEEP

24576:J3NLeGefCnE7Oduehsi0LHgZpJEdDZSx7k/:JdLeGRE7Osehsi0LHkJEtZI7s

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  29b6cf1a4baf2a73f50fe0d9bfbf8340fc8fa894c175491659c0c1fb68054b9a
- Size
  
  1.1MB
- MD5
  
  49cf41b3b9ef6fe2ad37a7b876a1a1f3
- SHA1
  
  7e2806720f8bdd6fc84093b302e7f10afe0ff174
- SHA256
  
  29b6cf1a4baf2a73f50fe0d9bfbf8340fc8fa894c175491659c0c1fb68054b9a
- SHA512
  
  7b052075f95d1ab61fd743fa26504025c3622d35085c3d912d7f1748e07a48a1b1966a70b94205687871f3a892a5965b00ddf1dcf881dfa075495cbda6d37967
- SSDEEP
  
  24576:J3NLeGefCnE7Oduehsi0LHgZpJEdDZSx7k/:JdLeGRE7Osehsi0LHkJEtZI7s
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2