0158c498205b7aa970b9a66fdbc213711716f283a1ff5c3704ce3b953c8ecb18 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0158c498205b7aa970b9a66fdbc213711716f283a1ff5c3704ce3b953c8ecb18
Size

8.9MB
Sample

240630-btff3svepl
MD5

947fb6c5e162feaf9e5ba99ca4d5e85e
SHA1

ab48c9b75ab00cba4c80b9958e5b7270516ca8e4
SHA256

0158c498205b7aa970b9a66fdbc213711716f283a1ff5c3704ce3b953c8ecb18
SHA512

136b0895b5f68f5d2dc75988efc953d259aba6251ec153552989833284b01436b11aebd811387e8675a8a3da5276a84fa9bb4e850f3c85f8eb02426d69ef340b
SSDEEP

98304:YUBqS4Y9l1GQmGg5TfF1rkTQuDPfOJf9309jTgvojmHvlYZ/AJIZa7uhx28:5zhGfffurfOJlQTS2YvlySyxv

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  0158c498205b7aa970b9a66fdbc213711716f283a1ff5c3704ce3b953c8ecb18
- Size
  
  8.9MB
- MD5
  
  947fb6c5e162feaf9e5ba99ca4d5e85e
- SHA1
  
  ab48c9b75ab00cba4c80b9958e5b7270516ca8e4
- SHA256
  
  0158c498205b7aa970b9a66fdbc213711716f283a1ff5c3704ce3b953c8ecb18
- SHA512
  
  136b0895b5f68f5d2dc75988efc953d259aba6251ec153552989833284b01436b11aebd811387e8675a8a3da5276a84fa9bb4e850f3c85f8eb02426d69ef340b
- SSDEEP
  
  98304:YUBqS4Y9l1GQmGg5TfF1rkTQuDPfOJf9309jTgvojmHvlYZ/AJIZa7uhx28:5zhGfffurfOJlQTS2YvlySyxv
Score

7^/10

spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2