hxxps://file[.]io/36XNSkST4e39 | Triage

Resubmissions

05/07/2024, 21:14

240705-z3llfswcjm 1

05/07/2024, 20:57

240705-zrlr3svhrp 10

Sharing

Copy URL Twitter E-mail

General

Target

https://file.io/36XNSkST4e39
Sample

240705-zrlr3svhrp

Score

10^/10

evasion execution persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  https://file.io/36XNSkST4e39
Score

10^/10

evasion execution persistence privilege_escalation spyware stealer
- Disables service(s)
  evasion execution
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

urlscan1

behavioral1

evasionexecutionpersistenceprivilege_escalationspywarestealer