4076b92cd0af98951860c0ab642235c1d5ac16fc5631609404e07f6146c5761e | Triage

Sharing

General

Target

4076b92cd0af98951860c0ab642235c1d5ac16fc5631609404e07f6146c5761e
Size

141KB
Sample

240605-w6yhmsec3y
MD5

685f11a52f62c8f26a22279dd1dae612
SHA1

99e77d3a8848b73e8e56a2e0716f05776c0f0ca3
SHA256

4076b92cd0af98951860c0ab642235c1d5ac16fc5631609404e07f6146c5761e
SHA512

3e742192bb8313cf105b112468f864c41db542a4b8f19ace0da2e5935d08e71c2dbdbd0e5a2e6b212fe458658e06dcc760937f08d75ef4266c797064219826f8
SSDEEP

3072:BUfZ4ZHUIbsRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:GMHiYHKreQ32hlBG

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  4076b92cd0af98951860c0ab642235c1d5ac16fc5631609404e07f6146c5761e
- Size
  
  141KB
- MD5
  
  685f11a52f62c8f26a22279dd1dae612
- SHA1
  
  99e77d3a8848b73e8e56a2e0716f05776c0f0ca3
- SHA256
  
  4076b92cd0af98951860c0ab642235c1d5ac16fc5631609404e07f6146c5761e
- SHA512
  
  3e742192bb8313cf105b112468f864c41db542a4b8f19ace0da2e5935d08e71c2dbdbd0e5a2e6b212fe458658e06dcc760937f08d75ef4266c797064219826f8
- SSDEEP
  
  3072:BUfZ4ZHUIbsRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:GMHiYHKreQ32hlBG
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2