1b9762418a47610e99cfd505c00a02883c31e8c30fee700a7f02daea2c13ec6c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b9762418a47610e99cfd505c00a02883c31e8c30fee700a7f02daea2c13ec6c
Size

74KB
Sample

240528-q8zktsgb5z
MD5

179249d6ed98ec0ee0f8ed3e9c8e5571
SHA1

cce8f7dc2149dbfde7abeca5e58254296dbc1766
SHA256

1b9762418a47610e99cfd505c00a02883c31e8c30fee700a7f02daea2c13ec6c
SHA512

b587204376148ed9dcbc2b8f66f6a7afbc5ef0784307cd4e1848d12ab0ae3d70b3bb6ef004f45ef6d9c50fbd0aa6b4a35bb25eb50360b2f2f69d427ee4dd6c57
SSDEEP

1536:qCX7cx1aeg1vlxJYDf97EToa9D4ZQKbgZi1dst7x9PxQ:Xrf9zYVlZQKbgZi1St7xQ

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  1b9762418a47610e99cfd505c00a02883c31e8c30fee700a7f02daea2c13ec6c
- Size
  
  74KB
- MD5
  
  179249d6ed98ec0ee0f8ed3e9c8e5571
- SHA1
  
  cce8f7dc2149dbfde7abeca5e58254296dbc1766
- SHA256
  
  1b9762418a47610e99cfd505c00a02883c31e8c30fee700a7f02daea2c13ec6c
- SHA512
  
  b587204376148ed9dcbc2b8f66f6a7afbc5ef0784307cd4e1848d12ab0ae3d70b3bb6ef004f45ef6d9c50fbd0aa6b4a35bb25eb50360b2f2f69d427ee4dd6c57
- SSDEEP
  
  1536:qCX7cx1aeg1vlxJYDf97EToa9D4ZQKbgZi1dst7x9PxQ:Xrf9zYVlZQKbgZi1St7xQ
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2