28b5cc5c96219f005904f5b19bb7834aa9968be4e48a8f452a24428b3fcb590b | Triage

Sharing

General

Target

28b5cc5c96219f005904f5b19bb7834aa9968be4e48a8f452a24428b3fcb590b.exe
Size

3.9MB
Sample

240704-bt52qsydpb
MD5

fbfff66051aa49a6a2efe9eecf73f0f0
SHA1

768f4ce97fcd28aa23e36a206c457f64f087f8a8
SHA256

28b5cc5c96219f005904f5b19bb7834aa9968be4e48a8f452a24428b3fcb590b
SHA512

e58a9ccdac999e31238a5a48623c4d940028f24a0d36f413016777e4dcc088973489dcb0cf3ab2ede5fae9aa6258f860fd58fadef87229df33d4e1b36ac60db9
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpVbVz8eLFcz

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  28b5cc5c96219f005904f5b19bb7834aa9968be4e48a8f452a24428b3fcb590b.exe
- Size
  
  3.9MB
- MD5
  
  fbfff66051aa49a6a2efe9eecf73f0f0
- SHA1
  
  768f4ce97fcd28aa23e36a206c457f64f087f8a8
- SHA256
  
  28b5cc5c96219f005904f5b19bb7834aa9968be4e48a8f452a24428b3fcb590b
- SHA512
  
  e58a9ccdac999e31238a5a48623c4d940028f24a0d36f413016777e4dcc088973489dcb0cf3ab2ede5fae9aa6258f860fd58fadef87229df33d4e1b36ac60db9
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LByB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpVbVz8eLFcz
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer