19d3824c60fc16430938c0120e39982093ac631570f2ed42d9cf1b738817c188 | Triage

Sharing

General

Target

19d3824c60fc16430938c0120e39982093ac631570f2ed42d9cf1b738817c188
Size

864KB
Sample

240706-xv4qystbjf
MD5

70b6803237853f5eb9a7aa1c3afdad7f
SHA1

93e79bed55e798e544b7554c820bf3e1fc1fcbed
SHA256

19d3824c60fc16430938c0120e39982093ac631570f2ed42d9cf1b738817c188
SHA512

47d7f8db39940d06520e889cbf10c926468d7799f1afdf4af0eb77cc106a600da918ff649223b5c0ec314ef19e757bf6777dbad3523c76cd4cc8b2034cb1e6b3
SSDEEP

12288:Zv1nWdQP1EDhZPxUTDYrGiVrzBrB8x4w6Ic7FQQN8e6yHI+1Dn+im49TOesj6DG3:Z9ndEVfUTpitz3FtFnNJ6m1jAes+DGL7

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  19d3824c60fc16430938c0120e39982093ac631570f2ed42d9cf1b738817c188
- Size
  
  864KB
- MD5
  
  70b6803237853f5eb9a7aa1c3afdad7f
- SHA1
  
  93e79bed55e798e544b7554c820bf3e1fc1fcbed
- SHA256
  
  19d3824c60fc16430938c0120e39982093ac631570f2ed42d9cf1b738817c188
- SHA512
  
  47d7f8db39940d06520e889cbf10c926468d7799f1afdf4af0eb77cc106a600da918ff649223b5c0ec314ef19e757bf6777dbad3523c76cd4cc8b2034cb1e6b3
- SSDEEP
  
  12288:Zv1nWdQP1EDhZPxUTDYrGiVrzBrB8x4w6Ic7FQQN8e6yHI+1Dn+im49TOesj6DG3:Z9ndEVfUTpitz3FtFnNJ6m1jAes+DGL7
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistence