1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5 | Triage

Sharing

General

Target

1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5
Size

556KB
Sample

240709-xq7baazejr
MD5

3f430d7cb9b35dca2c1b5bd97dc35dc2
SHA1

57cb573ecd71272f9f3eefd1e5cb7cff8c260e1b
SHA256

1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5
SHA512

e41259c2bdf972535bb46bef2d0a91044e1687f56d65e0b0f08831b42aa11a465ca7d25038593856881ba2233de8c1a0ff195aa65756cd8abce88180845c927b
SSDEEP

12288:JXCNi9BWWre0axaLdiFzNNBBX0LFB7DqDFmAgH4Cqb1IKKB9ylk/bh5MKcVp:sWGZaL01c7mDFmAgGRIKKSk/b/MKcP

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5
- Size
  
  556KB
- MD5
  
  3f430d7cb9b35dca2c1b5bd97dc35dc2
- SHA1
  
  57cb573ecd71272f9f3eefd1e5cb7cff8c260e1b
- SHA256
  
  1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5
- SHA512
  
  e41259c2bdf972535bb46bef2d0a91044e1687f56d65e0b0f08831b42aa11a465ca7d25038593856881ba2233de8c1a0ff195aa65756cd8abce88180845c927b
- SSDEEP
  
  12288:JXCNi9BWWre0axaLdiFzNNBBX0LFB7DqDFmAgH4Cqb1IKKB9ylk/bh5MKcVp:sWGZaL01c7mDFmAgGRIKKSk/b/MKcP
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer