ba527a404c5fbe3ba7aad4783e3a2b2311ed3d57a13e2c89da00407ff8781048 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba527a404c5fbe3ba7aad4783e3a2b2311ed3d57a13e2c89da00407ff8781048
Size

2.6MB
Sample

240711-fbpz1szbnk
MD5

5903a8fc3b180ffaaa182ed6c0e09040
SHA1

4e866daf5724641728cc5a44d6042752db832838
SHA256

ba527a404c5fbe3ba7aad4783e3a2b2311ed3d57a13e2c89da00407ff8781048
SHA512

c27708f9505317ee7f6c1285ec53e66ddc7d93575050deef4f1332017c5037f0a034e04cbc6fed7e89bb5d1f935b6bca18c6719bdb63aa6e56a8d844412bd98e
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUpsb

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  ba527a404c5fbe3ba7aad4783e3a2b2311ed3d57a13e2c89da00407ff8781048
- Size
  
  2.6MB
- MD5
  
  5903a8fc3b180ffaaa182ed6c0e09040
- SHA1
  
  4e866daf5724641728cc5a44d6042752db832838
- SHA256
  
  ba527a404c5fbe3ba7aad4783e3a2b2311ed3d57a13e2c89da00407ff8781048
- SHA512
  
  c27708f9505317ee7f6c1285ec53e66ddc7d93575050deef4f1332017c5037f0a034e04cbc6fed7e89bb5d1f935b6bca18c6719bdb63aa6e56a8d844412bd98e
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBrB/bS:sxX7QnxrloE5dpUpsb
Score

7^/10

persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer