0860aa8aa27afd81c6b7500e3f11e1320045f2880976b38a2d06a5efbff394da | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0860aa8aa27afd81c6b7500e3f11e1320045f2880976b38a2d06a5efbff394da
Size

563KB
Sample

240528-jtxz5ach63
MD5

50a7b06f3853ddf8a3770f10c2dd03d1
SHA1

29de6d7d2fb62b3396583b64cf2331a17da418f6
SHA256

0860aa8aa27afd81c6b7500e3f11e1320045f2880976b38a2d06a5efbff394da
SHA512

9b4b1fec3fa3d9c981b3c2bca3dd1464d9360a7da4c0d88b7ba057ec6baa8a6de9300c4ef125d50132452d668d809b0d5238d59f595ef7e3326c77a2fb6155e2
SSDEEP

12288:e3NKc9iJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9J618UtQ43iUa:e3NCVm2VZQwy9E1Vf3M

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  0860aa8aa27afd81c6b7500e3f11e1320045f2880976b38a2d06a5efbff394da
- Size
  
  563KB
- MD5
  
  50a7b06f3853ddf8a3770f10c2dd03d1
- SHA1
  
  29de6d7d2fb62b3396583b64cf2331a17da418f6
- SHA256
  
  0860aa8aa27afd81c6b7500e3f11e1320045f2880976b38a2d06a5efbff394da
- SHA512
  
  9b4b1fec3fa3d9c981b3c2bca3dd1464d9360a7da4c0d88b7ba057ec6baa8a6de9300c4ef125d50132452d668d809b0d5238d59f595ef7e3326c77a2fb6155e2
- SSDEEP
  
  12288:e3NKc9iJafmm2VYK+UNo0RweQfoAxHv9sN4A4H9J618UtQ43iUa:e3NCVm2VZQwy9E1Vf3M
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2