a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16 | Triage

Submit
Reports

Overview

overview

Static

static

a838c8d936...16.exe

windows7-x64

9

a838c8d936...16.exe

windows10-2004-x64

9

Sharing

General

Target

a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16
Size

751KB
Sample

240620-bzwp9a1fna
MD5

45483e7b9e8220de64e2586c35de15cd
SHA1

e28c2574418c3e916dcc5d743da20dece36788c7
SHA256

a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16
SHA512

ab16e6a98c01c93c39aa90f5f2057bb55ef10da92ce7a504822589bbd5ae3c56620e673e0042e8fef5f624ba890a284a16dfca6b09aca6dd6f0332778a8b5ebd
SSDEEP

12288:dXCNi9BuV+zbZKyurTpn8tMAFbgvKvgIEbO9kXcPgk9plwylaptHp0PKmIIzzZ:oWuV+h7urTp8rFPYID9kX0qiQJGvFzzZ

Score

10^/10

persistence spyware stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16.exe

Resource

win7-20240611-en

persistence spyware stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16.exe

Resource

win10v2004-20240508-en

persistence spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16
- Size
  
  751KB
- MD5
  
  45483e7b9e8220de64e2586c35de15cd
- SHA1
  
  e28c2574418c3e916dcc5d743da20dece36788c7
- SHA256
  
  a838c8d9360233ab7ec18b448a712d863d458dd1a54d26e18e1f252dda4abc16
- SHA512
  
  ab16e6a98c01c93c39aa90f5f2057bb55ef10da92ce7a504822589bbd5ae3c56620e673e0042e8fef5f624ba890a284a16dfca6b09aca6dd6f0332778a8b5ebd
- SSDEEP
  
  12288:dXCNi9BuV+zbZKyurTpn8tMAFbgvKvgIEbO9kXcPgk9plwylaptHp0PKmIIzzZ:oWuV+h7urTp8rFPYID9kX0qiQJGvFzzZ
Score

9^/10

persistence spyware stealer
- Detects executables containing possible sandbox analysis VM usernames
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer

© 2018-2025

Terms | Privacy