8030a0365df2dd935351b40497d6cd8418b919e4f8d077ca001e3321d1dfe56d | Triage

Resubmissions

07/08/2024, 06:45

240807-hjhl1sxbkg 9

Sharing

General

Target

ForcefullAdvocateV1.exe
Size

631KB
Sample

240807-hjhl1sxbkg
MD5

5e85dcaa180e1caf89db0b5959f1161e
SHA1

3f7532f8baceae20eb4e4b7c90e630f4fc3f52da
SHA256

8030a0365df2dd935351b40497d6cd8418b919e4f8d077ca001e3321d1dfe56d
SHA512

6c4550f269fdbd60e782f626797bcc77797ec6e1ba6e69e58bac050ee6f031b936cc4c0583555774bab3f3ff65bceab4bf221ea0c47a99710ebf1c4468a9dc1f
SSDEEP

12288:eYW8tvLbwacCG775kwgW5nMqAhsZVXOnLKlUU3w7oU/aRS40JU3vQatcUndd17oN:eBebwHRf5HnLnyU

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Targets

- Target
  
  ForcefullAdvocateV1.exe
- Size
  
  631KB
- MD5
  
  5e85dcaa180e1caf89db0b5959f1161e
- SHA1
  
  3f7532f8baceae20eb4e4b7c90e630f4fc3f52da
- SHA256
  
  8030a0365df2dd935351b40497d6cd8418b919e4f8d077ca001e3321d1dfe56d
- SHA512
  
  6c4550f269fdbd60e782f626797bcc77797ec6e1ba6e69e58bac050ee6f031b936cc4c0583555774bab3f3ff65bceab4bf221ea0c47a99710ebf1c4468a9dc1f
- SSDEEP
  
  12288:eYW8tvLbwacCG775kwgW5nMqAhsZVXOnLKlUU3w7oU/aRS40JU3vQatcUndd17oN:eBebwHRf5HnLnyU
Score

9^/10

discovery credential_access spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

credential_accessdiscoveryspywarestealer