b8540ef82a9bd2a6ac92fe499e97fd8e999e9677843454ee2bedde4540d55f7c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fe326838266d18d2690edb6fafcd2de0N.exe
Size

1.2MB
Sample

240819-zhktesvcpd
MD5

fe326838266d18d2690edb6fafcd2de0
SHA1

d34d109c0663ae38938883982164b5b9baab7f81
SHA256

b8540ef82a9bd2a6ac92fe499e97fd8e999e9677843454ee2bedde4540d55f7c
SHA512

ef151e73b8f278f807177deaf5499556b2fdf60d08c913d0dbacf3a16c2083977f836c708a9dd382dcd392905d36c000caab1d3e960bb652875de51f98ce93b2
SSDEEP

24576:XIZcwKCgt7TRHIDzDGDwpemIwpelCy5jcAkSYqyE5:XiKCUEzDGcpeapelbpYqZ

Score

8^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  fe326838266d18d2690edb6fafcd2de0N.exe
- Size
  
  1.2MB
- MD5
  
  fe326838266d18d2690edb6fafcd2de0
- SHA1
  
  d34d109c0663ae38938883982164b5b9baab7f81
- SHA256
  
  b8540ef82a9bd2a6ac92fe499e97fd8e999e9677843454ee2bedde4540d55f7c
- SHA512
  
  ef151e73b8f278f807177deaf5499556b2fdf60d08c913d0dbacf3a16c2083977f836c708a9dd382dcd392905d36c000caab1d3e960bb652875de51f98ce93b2
- SSDEEP
  
  24576:XIZcwKCgt7TRHIDzDGDwpemIwpelCy5jcAkSYqyE5:XiKCUEzDGcpeapelbpYqZ
Score

8^/10

discovery persistence spyware stealer
- Contacts a large (1006) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer