1270e1552e4f4aadb1cd88341ff2c78cfabbe26b235939d533bac1d49f40db3d | Triage

Sharing

General

Target

1270e1552e4f4aadb1cd88341ff2c78cfabbe26b235939d533bac1d49f40db3d
Size

285KB
Sample

240529-rjw9vahg69
MD5

66446804f070ed82c3819c50e4b9599f
SHA1

b0d8a8d131fdcae99bd93e57871ab0c20451a34a
SHA256

1270e1552e4f4aadb1cd88341ff2c78cfabbe26b235939d533bac1d49f40db3d
SHA512

f4b16c64c2118fb74d1b78af91b1ce8e40e3f7d524cd593ab66a3ee7f57dad75923af0a4d43689e044f55226acf1bbfe360e997f46b3ae261adfe2ebfb787ce0
SSDEEP

6144:81NM5pfMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:81upfMTi0uhMqe9ts2zWTpMmCG7W

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  1270e1552e4f4aadb1cd88341ff2c78cfabbe26b235939d533bac1d49f40db3d
- Size
  
  285KB
- MD5
  
  66446804f070ed82c3819c50e4b9599f
- SHA1
  
  b0d8a8d131fdcae99bd93e57871ab0c20451a34a
- SHA256
  
  1270e1552e4f4aadb1cd88341ff2c78cfabbe26b235939d533bac1d49f40db3d
- SHA512
  
  f4b16c64c2118fb74d1b78af91b1ce8e40e3f7d524cd593ab66a3ee7f57dad75923af0a4d43689e044f55226acf1bbfe360e997f46b3ae261adfe2ebfb787ce0
- SSDEEP
  
  6144:81NM5pfMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:81upfMTi0uhMqe9ts2zWTpMmCG7W
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2