f921bfd6b7f8ce3901dbd52464de9d462774cb02c0c23efc510ca48d5991bf5e | Triage

Sharing

General

Target

f921bfd6b7f8ce3901dbd52464de9d462774cb02c0c23efc510ca48d5991bf5e
Size

159KB
Sample

240611-fz299awfnl
MD5

af12bf1bb9cd1be02f570b537d3bb86a
SHA1

181586056114ece7d5a1c6ca52c6f312d51727b9
SHA256

f921bfd6b7f8ce3901dbd52464de9d462774cb02c0c23efc510ca48d5991bf5e
SHA512

1f81bb04d431db4d54094dc97d0f97aea2896ebc6149fb5951696282216c57001be02427e12b92c3181a1eb8691ffd0a28405c3771f2b356cd330f29fbf6fd9b
SSDEEP

3072:9jh85+KsgX/VECQZBbvcKJbSXtEZs12Q/S6QcGOX0Fw2haGfvkzDOvv1U4Glxpwl:9jhw+7CCClobQtmE73j0FjhHfv4410ZK

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  f921bfd6b7f8ce3901dbd52464de9d462774cb02c0c23efc510ca48d5991bf5e
- Size
  
  159KB
- MD5
  
  af12bf1bb9cd1be02f570b537d3bb86a
- SHA1
  
  181586056114ece7d5a1c6ca52c6f312d51727b9
- SHA256
  
  f921bfd6b7f8ce3901dbd52464de9d462774cb02c0c23efc510ca48d5991bf5e
- SHA512
  
  1f81bb04d431db4d54094dc97d0f97aea2896ebc6149fb5951696282216c57001be02427e12b92c3181a1eb8691ffd0a28405c3771f2b356cd330f29fbf6fd9b
- SSDEEP
  
  3072:9jh85+KsgX/VECQZBbvcKJbSXtEZs12Q/S6QcGOX0Fw2haGfvkzDOvv1U4Glxpwl:9jhw+7CCClobQtmE73j0FjhHfv4410ZK
Score

7^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer