42de94e91bbb8c2311d208939ccceaa727cc7126832b0c49913d5854c58b5dda | Triage

Sharing

General

Target

42de94e91bbb8c2311d208939ccceaa727cc7126832b0c49913d5854c58b5dda
Size

66KB
Sample

240722-rrd38sshln
MD5

42ea2160234ae3cd4aa9d48157733f83
SHA1

2717bafac70d06e5bcd1482d6877ebc65bb915b8
SHA256

42de94e91bbb8c2311d208939ccceaa727cc7126832b0c49913d5854c58b5dda
SHA512

b76909e487fedb53c9615680f144484a94e6384d617ed3bb33ebd2d062e0d200063820a60aa608fbc44bcc9dbecd5d3d67b5185645851528ad2e50024f8c2c65
SSDEEP

1536:eFcx1ae9n40g9i/qo6SKHlC4ayFGyHNXk:eFfZQioJKFC+4yHN0

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  42de94e91bbb8c2311d208939ccceaa727cc7126832b0c49913d5854c58b5dda
- Size
  
  66KB
- MD5
  
  42ea2160234ae3cd4aa9d48157733f83
- SHA1
  
  2717bafac70d06e5bcd1482d6877ebc65bb915b8
- SHA256
  
  42de94e91bbb8c2311d208939ccceaa727cc7126832b0c49913d5854c58b5dda
- SHA512
  
  b76909e487fedb53c9615680f144484a94e6384d617ed3bb33ebd2d062e0d200063820a60aa608fbc44bcc9dbecd5d3d67b5185645851528ad2e50024f8c2c65
- SSDEEP
  
  1536:eFcx1ae9n40g9i/qo6SKHlC4ayFGyHNXk:eFfZQioJKFC+4yHN0
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2