b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c | Triage

Sharing

General

Target

b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c
Size

869KB
Sample

240628-b7lj9avbjf
MD5

52301e2e4f83bc459f2a1fc537000853
SHA1

d32fd82310fdb782a2ae0c6a7b5cb87ee779bb08
SHA256

b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c
SHA512

8f157f9814b9d48d9455545d9a27e2009f28080d12ecb140b00a47f508c3bd94ed8a93f2a2fe2e22a1b46a558c345fc5e85b1c2ed80d5d5672c4f00f6d70073e
SSDEEP

12288:/n8yN0Mr8ZL6aVs7IypwXK4Qzh+jMlWCEh/yr5QE00vZ5McAA9YlO3d:vPuZLzIfpwiz0wy/ylQd0ccdYlO3d

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c
- Size
  
  869KB
- MD5
  
  52301e2e4f83bc459f2a1fc537000853
- SHA1
  
  d32fd82310fdb782a2ae0c6a7b5cb87ee779bb08
- SHA256
  
  b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c
- SHA512
  
  8f157f9814b9d48d9455545d9a27e2009f28080d12ecb140b00a47f508c3bd94ed8a93f2a2fe2e22a1b46a558c345fc5e85b1c2ed80d5d5672c4f00f6d70073e
- SSDEEP
  
  12288:/n8yN0Mr8ZL6aVs7IypwXK4Qzh+jMlWCEh/yr5QE00vZ5McAA9YlO3d:vPuZLzIfpwiz0wy/ylQd0ccdYlO3d
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer