17e9f22038c2cb804756665b2338c06e8275eab6216e76ab082eeadb2696e77d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17e9f22038c2cb804756665b2338c06e8275eab6216e76ab082eeadb2696e77d
Size

963KB
Sample

240708-qbqxeszfml
MD5

805ab2b8fe75fccf3415f1305de4d204
SHA1

bb235fd68eb02fb3096d800085f9c5eb57dbe791
SHA256

17e9f22038c2cb804756665b2338c06e8275eab6216e76ab082eeadb2696e77d
SHA512

28193ec96d99bb75582f0031470960ae406630fcc7e8c7be9e5234103954e374e7334e770c2d47e387c758e892c5cff13c6807de695b7b1cdd51e45b27421a2f
SSDEEP

12288:vYRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:vNBpDRmi78gkPXlyo0G/jr

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  17e9f22038c2cb804756665b2338c06e8275eab6216e76ab082eeadb2696e77d
- Size
  
  963KB
- MD5
  
  805ab2b8fe75fccf3415f1305de4d204
- SHA1
  
  bb235fd68eb02fb3096d800085f9c5eb57dbe791
- SHA256
  
  17e9f22038c2cb804756665b2338c06e8275eab6216e76ab082eeadb2696e77d
- SHA512
  
  28193ec96d99bb75582f0031470960ae406630fcc7e8c7be9e5234103954e374e7334e770c2d47e387c758e892c5cff13c6807de695b7b1cdd51e45b27421a2f
- SSDEEP
  
  12288:vYRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:vNBpDRmi78gkPXlyo0G/jr
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2