c11fab88c4ec3a535135389ada537d37d4e1ff93b61f3735800588133bcaa73c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c11fab88c4ec3a535135389ada537d37d4e1ff93b61f3735800588133bcaa73c
Size

3.0MB
Sample

240809-cdqsjsyckb
MD5

cb07d47e6f83ea340f25fe0d97252b48
SHA1

746f951ead450acc3ce2ff5e5a18a1a7d56867a1
SHA256

c11fab88c4ec3a535135389ada537d37d4e1ff93b61f3735800588133bcaa73c
SHA512

52fd0df1f717ae4e568678e0a6d6ae635814ef165034ff7763721d6a7e48af6fe5e3af4c8e6f776c67d23e50bf075e0b36a973bf97c1ce2413bb9915140d74ff
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bSqz8b6LNX:sxX7QnxrloE5dpUpFbVz8eLF

Score

9^/10

credential_access discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  c11fab88c4ec3a535135389ada537d37d4e1ff93b61f3735800588133bcaa73c
- Size
  
  3.0MB
- MD5
  
  cb07d47e6f83ea340f25fe0d97252b48
- SHA1
  
  746f951ead450acc3ce2ff5e5a18a1a7d56867a1
- SHA256
  
  c11fab88c4ec3a535135389ada537d37d4e1ff93b61f3735800588133bcaa73c
- SHA512
  
  52fd0df1f717ae4e568678e0a6d6ae635814ef165034ff7763721d6a7e48af6fe5e3af4c8e6f776c67d23e50bf075e0b36a973bf97c1ce2413bb9915140d74ff
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB6B/bSqz8b6LNX:sxX7QnxrloE5dpUpFbVz8eLF
Score

9^/10

credential_access discovery persistence spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoverypersistencespywarestealer

behavioral2

credential_accessdiscoverypersistencespywarestealer