51af0700c97195381cf259ad801efcf332a36ebae03cb8c71ee369b84d6eafde | Triage

Sharing

General

Target

51af0700c97195381cf259ad801efcf332a36ebae03cb8c71ee369b84d6eafde
Size

552KB
Sample

240704-1jbskssglf
MD5

2fad3159f14ced981ffa9dd4dbbdd384
SHA1

399622fc00a029d5e88520b5df682714f82e83eb
SHA256

51af0700c97195381cf259ad801efcf332a36ebae03cb8c71ee369b84d6eafde
SHA512

78b853cf2d77547ab38c29a1493993a3ae165e0c868248a315a13e35574c86a68aad2b7587ee85a76feb6fc0d199c6791c64c15be8706caf013cbf61a8fce0c8
SSDEEP

12288:dXCNi9BmBDNME+R6kz29xuvWvfYrkxNzC1X4lyhXJ6frFUn:oWmvk0N9xcYzwoYJ0rCn

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  51af0700c97195381cf259ad801efcf332a36ebae03cb8c71ee369b84d6eafde
- Size
  
  552KB
- MD5
  
  2fad3159f14ced981ffa9dd4dbbdd384
- SHA1
  
  399622fc00a029d5e88520b5df682714f82e83eb
- SHA256
  
  51af0700c97195381cf259ad801efcf332a36ebae03cb8c71ee369b84d6eafde
- SHA512
  
  78b853cf2d77547ab38c29a1493993a3ae165e0c868248a315a13e35574c86a68aad2b7587ee85a76feb6fc0d199c6791c64c15be8706caf013cbf61a8fce0c8
- SSDEEP
  
  12288:dXCNi9BmBDNME+R6kz29xuvWvfYrkxNzC1X4lyhXJ6frFUn:oWmvk0N9xcYzwoYJ0rCn
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer