aa20ca0636cbbe5d3ab050ee58ebdefa41e00e4d47f42639fbdde358a290cb57 | Triage

Sharing

General

Target

aa20ca0636cbbe5d3ab050ee58ebdefa41e00e4d47f42639fbdde358a290cb57
Size

3.1MB
Sample

240818-2yzzdssgnq
MD5

dd3949ea4b800c3f3be7bbb757172c7a
SHA1

66402e6024d96afe520b8f31fbf00199b4b33c73
SHA256

aa20ca0636cbbe5d3ab050ee58ebdefa41e00e4d47f42639fbdde358a290cb57
SHA512

b71ce8d3eeffc8c9901979a512ebacad87b8b585d1c496affc4edf82068f3971505630988b5a88c5ff5edc110de20046bcfc071dcba849525554496980d17fe8
SSDEEP

49152:XVAbw8VyRPkVwSdyKE6a8anqApzEVZnk8m0Uf89+zvi1QXsy4TpM+DWUl+n1aso:FA7VyRPS7MLq4ykF09+riyXWz6Ha

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  aa20ca0636cbbe5d3ab050ee58ebdefa41e00e4d47f42639fbdde358a290cb57
- Size
  
  3.1MB
- MD5
  
  dd3949ea4b800c3f3be7bbb757172c7a
- SHA1
  
  66402e6024d96afe520b8f31fbf00199b4b33c73
- SHA256
  
  aa20ca0636cbbe5d3ab050ee58ebdefa41e00e4d47f42639fbdde358a290cb57
- SHA512
  
  b71ce8d3eeffc8c9901979a512ebacad87b8b585d1c496affc4edf82068f3971505630988b5a88c5ff5edc110de20046bcfc071dcba849525554496980d17fe8
- SSDEEP
  
  49152:XVAbw8VyRPkVwSdyKE6a8anqApzEVZnk8m0Uf89+zvi1QXsy4TpM+DWUl+n1aso:FA7VyRPS7MLq4ykF09+riyXWz6Ha
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryspywarestealer