deerstealer

Resubmissions

23/08/2024, 09:01

240823-kzcrtavflb 10

23/08/2024, 09:01

240823-kyw43axfmj 10

28/07/2024, 15:31

240728-syhwfavdjd 10

Sharing

Copy URL

Twitter E-mail

General

Target

77.91.77.81
Size

1.7MB
Sample

240728-syhwfavdjd
MD5

4640faeafa95ce219c649e9f5cbffd75
SHA1

19dd0e5c193e679825066ea9faa8c283a3d62cdd
SHA256

5e2839553458547a92fff7348862063b30510e805a550e02d94a89bd8fd0768d
SHA512

23e9c70521be23aeb74da4711149e6a61d678713dbfd6de7a5f835bd2931ad227a8988ab66d6a44d1b7f83b8e8cea23fef0f6ed4c2c3399b214bd812dfc998cb
SSDEEP

49152:ROG8g1q+0zLvddLpmLM1vkRG6PDaChedUaq4UL:Mzdg

Score

10^/10

Malware Config

Targets

- Target
  
  77.91.77.81
- Size
  
  1.7MB
- MD5
  
  4640faeafa95ce219c649e9f5cbffd75
- SHA1
  
  19dd0e5c193e679825066ea9faa8c283a3d62cdd
- SHA256
  
  5e2839553458547a92fff7348862063b30510e805a550e02d94a89bd8fd0768d
- SHA512
  
  23e9c70521be23aeb74da4711149e6a61d678713dbfd6de7a5f835bd2931ad227a8988ab66d6a44d1b7f83b8e8cea23fef0f6ed4c2c3399b214bd812dfc998cb
- SSDEEP
  
  49152:ROG8g1q+0zLvddLpmLM1vkRG6PDaChedUaq4UL:Mzdg
Score

10^/10

stealer credential_access discovery spyware
- DeerStealer
  Detects DeerStealer malware - JaffaCakes118.
  stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Credentials from Password Stores: Credentials from Web Browsers

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2