4bd38f9aeff9c0facd545db47f1b0237edaefff6658584c55628af797408a26a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

setup-istripper_jwU3kaDkMVk13NtBDKkEsEwZZFSU1SUF1.exe
Size

93.8MB
Sample

240720-sspf2a1hnk
MD5

f13b48fda11048bc2e8149bd632c57d9
SHA1

c89511be35e771e593fbe159a3bc51bcff21a04e
SHA256

4bd38f9aeff9c0facd545db47f1b0237edaefff6658584c55628af797408a26a
SHA512

895bbed8c7a8ada54fa07558dafc4eea645bf86cbafef3b9b0db8c1881ffc8761738593bfa5e702b56fbe1c4fba1cf12910d5dde386e5cb430ef3b90bfbcc6ba
SSDEEP

1572864:Yb2S3DaSwNZjMpAmVii2viOiYUOBrJohbrQo/Iu0+xGPzrMk1wjjdkqCOArdztpM:e13Tc4AmsBHiYU0rJsbUognYqzt1w3dN

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  setup-istripper_jwU3kaDkMVk13NtBDKkEsEwZZFSU1SUF1.exe
- Size
  
  93.8MB
- MD5
  
  f13b48fda11048bc2e8149bd632c57d9
- SHA1
  
  c89511be35e771e593fbe159a3bc51bcff21a04e
- SHA256
  
  4bd38f9aeff9c0facd545db47f1b0237edaefff6658584c55628af797408a26a
- SHA512
  
  895bbed8c7a8ada54fa07558dafc4eea645bf86cbafef3b9b0db8c1881ffc8761738593bfa5e702b56fbe1c4fba1cf12910d5dde386e5cb430ef3b90bfbcc6ba
- SSDEEP
  
  1572864:Yb2S3DaSwNZjMpAmVii2viOiYUOBrJohbrQo/Iu0+xGPzrMk1wjjdkqCOArdztpM:e13Tc4AmsBHiYU0rJsbUognYqzt1w3dN
Score

7^/10

discovery persistence spyware stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer