fc08af92d90b57c8a54ecee4b207fb97bf4c08409a3e819d9046c256d9991f46 | Triage

Sharing

General

Target

OperaSetup.exe
Size

2.0MB
Sample

240531-qlyd9aaf27
MD5

81d4a82d7fd6f54a7029a278003f5105
SHA1

891324e3703c11a6495fcedf1f447b3ea38648e7
SHA256

fc08af92d90b57c8a54ecee4b207fb97bf4c08409a3e819d9046c256d9991f46
SHA512

b5f66d891a29d56f8b7c71c175ff682d9aba4f40601ae7364f92e306fa8ff47996445b1fbfa267d6a74dfc469debffcc7a4e938006fdea17ec5e5fb891dde9f3
SSDEEP

49152:1NEyYcQ78Kpjjxv6htWn1iTl0egZ3s0OSZsnh7f3kHMqD:DEP784oysWj3s0GhYMqD

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  OperaSetup.exe
- Size
  
  2.0MB
- MD5
  
  81d4a82d7fd6f54a7029a278003f5105
- SHA1
  
  891324e3703c11a6495fcedf1f447b3ea38648e7
- SHA256
  
  fc08af92d90b57c8a54ecee4b207fb97bf4c08409a3e819d9046c256d9991f46
- SHA512
  
  b5f66d891a29d56f8b7c71c175ff682d9aba4f40601ae7364f92e306fa8ff47996445b1fbfa267d6a74dfc469debffcc7a4e938006fdea17ec5e5fb891dde9f3
- SSDEEP
  
  49152:1NEyYcQ78Kpjjxv6htWn1iTl0egZ3s0OSZsnh7f3kHMqD:DEP784oysWj3s0GhYMqD
Score

8^/10

spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2