20c139c3cd89af55c9a6582f3da1e5ab52040346a250381e1906cfdd1362f4b4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20c139c3cd89af55c9a6582f3da1e5ab52040346a250381e1906cfdd1362f4b4
Size

93KB
Sample

240605-x7g3qagd46
MD5

19cb66bf05ea1461b4a1c754e88fe9c1
SHA1

fc19302004da12dc8bd7ad8a79d44b65059f9eb4
SHA256

20c139c3cd89af55c9a6582f3da1e5ab52040346a250381e1906cfdd1362f4b4
SHA512

16e079bf3be8bd78e718f73915b0e44ddc050a65edcfe25f4328a3f3e6bcd94b89ed1d5b07e31e8f9c60f30e32e41418148b24f5e202716aac035c8b4793dbc1
SSDEEP

1536:BUcx1ae9n40g4ZoeVWsHh3jF87JvJnBpwdaMIOOnToIfiV6pdQ:BUfZ4ZHUIgJvxKaCqTBfioo

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  20c139c3cd89af55c9a6582f3da1e5ab52040346a250381e1906cfdd1362f4b4
- Size
  
  93KB
- MD5
  
  19cb66bf05ea1461b4a1c754e88fe9c1
- SHA1
  
  fc19302004da12dc8bd7ad8a79d44b65059f9eb4
- SHA256
  
  20c139c3cd89af55c9a6582f3da1e5ab52040346a250381e1906cfdd1362f4b4
- SHA512
  
  16e079bf3be8bd78e718f73915b0e44ddc050a65edcfe25f4328a3f3e6bcd94b89ed1d5b07e31e8f9c60f30e32e41418148b24f5e202716aac035c8b4793dbc1
- SSDEEP
  
  1536:BUcx1ae9n40g4ZoeVWsHh3jF87JvJnBpwdaMIOOnToIfiV6pdQ:BUfZ4ZHUIgJvxKaCqTBfioo
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2