fa3265e398e0facce4c06a083e279f3ca1669a2e9ae0ffe59126077bd508da2b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa3265e398e0facce4c06a083e279f3ca1669a2e9ae0ffe59126077bd508da2b
Size

2.0MB
Sample

240627-3j3x6s1dpp
MD5

5de1825ca0339215e90e5f4dcde517b6
SHA1

b2742a929571db4db77cf11a8019c9c65b8815a5
SHA256

fa3265e398e0facce4c06a083e279f3ca1669a2e9ae0ffe59126077bd508da2b
SHA512

06aeca5275731defe2fa7475494e4c728b0a760f242eb871a2c60546b78b1a7f1be71d2c34dff414f558e7316fd072a2925e5b32f6a19f902486a250d1fe2387
SSDEEP

49152:ZNEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkj:XEhFvqXjbqoJQC5

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  fa3265e398e0facce4c06a083e279f3ca1669a2e9ae0ffe59126077bd508da2b
- Size
  
  2.0MB
- MD5
  
  5de1825ca0339215e90e5f4dcde517b6
- SHA1
  
  b2742a929571db4db77cf11a8019c9c65b8815a5
- SHA256
  
  fa3265e398e0facce4c06a083e279f3ca1669a2e9ae0ffe59126077bd508da2b
- SHA512
  
  06aeca5275731defe2fa7475494e4c728b0a760f242eb871a2c60546b78b1a7f1be71d2c34dff414f558e7316fd072a2925e5b32f6a19f902486a250d1fe2387
- SSDEEP
  
  49152:ZNEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkj:XEhFvqXjbqoJQC5
Score

8^/10

spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2