4fe92a121dde375be6caac817ba29d4ae9964a1f8b453313efeddecc42d1d2be | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4fe92a121dde375be6caac817ba29d4ae9964a1f8b453313efeddecc42d1d2be
Size

963KB
Sample

240803-jp9hcsxbjp
MD5

b9f28bce2a36284e0f5f42776b080200
SHA1

981f6481265d9797d466859b789f1064b2ce569e
SHA256

4fe92a121dde375be6caac817ba29d4ae9964a1f8b453313efeddecc42d1d2be
SHA512

97ae94186b4dce8cf99a361572e598fbd3c29c1c39621551c0ceb1453b633e0136b0f9d13fadc16cfcaa538bfa688460a5b0cf2564d42e3d34a914105596df63
SSDEEP

12288:GYRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:GNBpDRmi78gkPXlyo0G/jr

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  4fe92a121dde375be6caac817ba29d4ae9964a1f8b453313efeddecc42d1d2be
- Size
  
  963KB
- MD5
  
  b9f28bce2a36284e0f5f42776b080200
- SHA1
  
  981f6481265d9797d466859b789f1064b2ce569e
- SHA256
  
  4fe92a121dde375be6caac817ba29d4ae9964a1f8b453313efeddecc42d1d2be
- SHA512
  
  97ae94186b4dce8cf99a361572e598fbd3c29c1c39621551c0ceb1453b633e0136b0f9d13fadc16cfcaa538bfa688460a5b0cf2564d42e3d34a914105596df63
- SSDEEP
  
  12288:GYRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:GNBpDRmi78gkPXlyo0G/jr
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer