629a6925581823b927902a3b4946380ed870a183488a220d8739ff0bca443d71 | Triage

Sharing

General

Target

629a6925581823b927902a3b4946380ed870a183488a220d8739ff0bca443d71
Size

2.0MB
Sample

240627-2vl85awela
MD5

45a38008e34cbad6f3b9be263d0dbb07
SHA1

b2ae2b760523b9e9acef2cb2ccfd3734ea1ec961
SHA256

629a6925581823b927902a3b4946380ed870a183488a220d8739ff0bca443d71
SHA512

79a863a6637461e32f762f282e8a87d8bc6339285cd20e4ec0c49cab8e111e30c3a446588e8fd7c641202be09d887521f539d7f7d1b8bd097e974d50f2b8e142
SSDEEP

49152:7NEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkn:hEhFvqXjbqoJQCl

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  629a6925581823b927902a3b4946380ed870a183488a220d8739ff0bca443d71
- Size
  
  2.0MB
- MD5
  
  45a38008e34cbad6f3b9be263d0dbb07
- SHA1
  
  b2ae2b760523b9e9acef2cb2ccfd3734ea1ec961
- SHA256
  
  629a6925581823b927902a3b4946380ed870a183488a220d8739ff0bca443d71
- SHA512
  
  79a863a6637461e32f762f282e8a87d8bc6339285cd20e4ec0c49cab8e111e30c3a446588e8fd7c641202be09d887521f539d7f7d1b8bd097e974d50f2b8e142
- SSDEEP
  
  49152:7NEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkn:hEhFvqXjbqoJQCl
Score

8^/10

spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2