1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8 | Triage

Sharing

General

Target

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe
Size

830KB
Sample

240715-syw33axdql
MD5

6498c822022751dbe8abb655e6ac9db0
SHA1

0b2d21b6a282deba1b49c3a8d74d66169f4af360
SHA256

1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8
SHA512

bd4ddcf7fd6a9212a6b9da7faa764c6546a0ee5d36f596cabd9f852407a3dc79304d265dea710ee2b4217ea026e6d87100644a2b9bd5b581b7b390a413f44721
SSDEEP

12288:F0d1IpkiOKnXjdVNhjGJRc4wHyeptmygUUArFbXGR5PXLMcoPiNAqgSoNzQ4iWTP:F0d1CdVuJm26wygUUArZGRxyj88

Score

7^/10

collection spyware stealer

Malware Config

Targets

- Target
  
  1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8.exe
- Size
  
  830KB
- MD5
  
  6498c822022751dbe8abb655e6ac9db0
- SHA1
  
  0b2d21b6a282deba1b49c3a8d74d66169f4af360
- SHA256
  
  1b32bfbc6412d6abaa2df4f530b3a7587c4f73a6cb6db93b421ecaca33e508d8
- SHA512
  
  bd4ddcf7fd6a9212a6b9da7faa764c6546a0ee5d36f596cabd9f852407a3dc79304d265dea710ee2b4217ea026e6d87100644a2b9bd5b581b7b390a413f44721
- SSDEEP
  
  12288:F0d1IpkiOKnXjdVNhjGJRc4wHyeptmygUUArFbXGR5PXLMcoPiNAqgSoNzQ4iWTP:F0d1CdVuJm26wygUUArZGRxyj88
Score

7^/10

collection spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Credentials in Registry

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectionspywarestealer

behavioral2

collectionspywarestealer