4577c97bab8dc2f6775a231a2fca10a8f2098a8820311070851dc59f4a43fbc9 | Triage

Sharing

General

Target

4577c97bab8dc2f6775a231a2fca10a8f2098a8820311070851dc59f4a43fbc9
Size

17KB
Sample

240727-chtd8stakb
MD5

74eb853b76e28eb89a4a3dd5c245845d
SHA1

c7063ec328b4ce7ec11bddbec835dad26a02b79c
SHA256

4577c97bab8dc2f6775a231a2fca10a8f2098a8820311070851dc59f4a43fbc9
SHA512

36087a42e190893c2451d43f5981181b793a386d90161ef3e3bbce6f4f47efa53ab728973cf9d30b3e190529177dee0aeeb311228456db95a8e44575bcbdc404
SSDEEP

384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/SPCw:IMAQ+BzWPEwnE+KHM2/SPCw

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  4577c97bab8dc2f6775a231a2fca10a8f2098a8820311070851dc59f4a43fbc9
- Size
  
  17KB
- MD5
  
  74eb853b76e28eb89a4a3dd5c245845d
- SHA1
  
  c7063ec328b4ce7ec11bddbec835dad26a02b79c
- SHA256
  
  4577c97bab8dc2f6775a231a2fca10a8f2098a8820311070851dc59f4a43fbc9
- SHA512
  
  36087a42e190893c2451d43f5981181b793a386d90161ef3e3bbce6f4f47efa53ab728973cf9d30b3e190529177dee0aeeb311228456db95a8e44575bcbdc404
- SSDEEP
  
  384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/SPCw:IMAQ+BzWPEwnE+KHM2/SPCw
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer