532b993a90d663d6a54429fbcc2aa4d9ee27759837991fb7636d1ffa7b9ca0c7 | Triage

Sharing

General

Target

532b993a90d663d6a54429fbcc2aa4d9ee27759837991fb7636d1ffa7b9ca0c7
Size

390KB
Sample

240709-2c4qfs1epf
MD5

3c80a421eb587211119eb655d33185b3
SHA1

348dd5f735fb6035528118e3448bcb2ef9e516de
SHA256

532b993a90d663d6a54429fbcc2aa4d9ee27759837991fb7636d1ffa7b9ca0c7
SHA512

a32359b4aee660fc1f35c7a4de5c806a97fac535811f8baaae687d7e3f5542f4ddfc18a1d117fd3e64eb756548c4de09b8ebdd4770010a9c234ad7c74cc86154
SSDEEP

6144:dXC4vgmhbIxs3NBBxtIWgbpMO0RxMynkFZq3BY8FIGIs12DuBVUwalmD2byYOddY:dXCNi9BopMO0RxMpj4IGIs1alrVoY

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  532b993a90d663d6a54429fbcc2aa4d9ee27759837991fb7636d1ffa7b9ca0c7
- Size
  
  390KB
- MD5
  
  3c80a421eb587211119eb655d33185b3
- SHA1
  
  348dd5f735fb6035528118e3448bcb2ef9e516de
- SHA256
  
  532b993a90d663d6a54429fbcc2aa4d9ee27759837991fb7636d1ffa7b9ca0c7
- SHA512
  
  a32359b4aee660fc1f35c7a4de5c806a97fac535811f8baaae687d7e3f5542f4ddfc18a1d117fd3e64eb756548c4de09b8ebdd4770010a9c234ad7c74cc86154
- SSDEEP
  
  6144:dXC4vgmhbIxs3NBBxtIWgbpMO0RxMynkFZq3BY8FIGIs12DuBVUwalmD2byYOddY:dXCNi9BopMO0RxMpj4IGIs1alrVoY
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer