ec89c6732b95fb3585dcdcf430f8d06fc6f05e778796a526e8291730178c59b6 | Triage

Sharing

General

Target

ec89c6732b95fb3585dcdcf430f8d06fc6f05e778796a526e8291730178c59b6
Size

236KB
Sample

240707-fs8tfsxake
MD5

90a45d1cbfc0493cd2912e390a03ebed
SHA1

803627aa80f2e331be2042f62074d609e5e2a442
SHA256

ec89c6732b95fb3585dcdcf430f8d06fc6f05e778796a526e8291730178c59b6
SHA512

f940686bb6490a4478d46b2cf057ccdb798c0a5f3d2bb975e64f9e03086dd88130878ec57cfeb396c9208a39b9e6a9562e0dee9f6d1ac27f035f595f95c34203
SSDEEP

6144:dXC4vgmhbIxs3NBBFk2T6hLs2qsaJdcEU5TCn47uomjv:dXCNi9BMekG7gTC4Q

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  ec89c6732b95fb3585dcdcf430f8d06fc6f05e778796a526e8291730178c59b6
- Size
  
  236KB
- MD5
  
  90a45d1cbfc0493cd2912e390a03ebed
- SHA1
  
  803627aa80f2e331be2042f62074d609e5e2a442
- SHA256
  
  ec89c6732b95fb3585dcdcf430f8d06fc6f05e778796a526e8291730178c59b6
- SHA512
  
  f940686bb6490a4478d46b2cf057ccdb798c0a5f3d2bb975e64f9e03086dd88130878ec57cfeb396c9208a39b9e6a9562e0dee9f6d1ac27f035f595f95c34203
- SSDEEP
  
  6144:dXC4vgmhbIxs3NBBFk2T6hLs2qsaJdcEU5TCn47uomjv:dXCNi9BMekG7gTC4Q
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer