28f9014ef8781f01a437a7bc88b51138a85b457285e353e09b57ee93dce8d2d3 | Triage

Sharing

General

Target

28f9014ef8781f01a437a7bc88b51138a85b457285e353e09b57ee93dce8d2d3
Size

53KB
Sample

240528-jynbgsbh9x
MD5

11b8817a1db9277f0052a62660ec600e
SHA1

b0e4bd9a440ea87618bfd0f759f17ec0c6b9701e
SHA256

28f9014ef8781f01a437a7bc88b51138a85b457285e353e09b57ee93dce8d2d3
SHA512

61cfe18d95dbac2eb90cf1cddb72ac504e5acb4c6a00d59450b438c1509bd31979f12b2415a919e254d7007c26fc31183bc56ab59583d5c1d3a88ee95d53a1d7
SSDEEP

1536:PhUaYzMXqtGNttyUn01Q78a4RgphWNFaWp:PhUaY46tGNttyJQ7KR0WDzp

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  28f9014ef8781f01a437a7bc88b51138a85b457285e353e09b57ee93dce8d2d3
- Size
  
  53KB
- MD5
  
  11b8817a1db9277f0052a62660ec600e
- SHA1
  
  b0e4bd9a440ea87618bfd0f759f17ec0c6b9701e
- SHA256
  
  28f9014ef8781f01a437a7bc88b51138a85b457285e353e09b57ee93dce8d2d3
- SHA512
  
  61cfe18d95dbac2eb90cf1cddb72ac504e5acb4c6a00d59450b438c1509bd31979f12b2415a919e254d7007c26fc31183bc56ab59583d5c1d3a88ee95d53a1d7
- SSDEEP
  
  1536:PhUaYzMXqtGNttyUn01Q78a4RgphWNFaWp:PhUaY46tGNttyJQ7KR0WDzp
Score

8^/10

spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2