20a3491a0c95f9594375effd26163dc2891b9b443164a74c8aad8a14966b1b54 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

91246a1bcb2eacf617cc0094ac3bd9b0N.exe
Size

2.0MB
Sample

240822-p9419sybjf
MD5

91246a1bcb2eacf617cc0094ac3bd9b0
SHA1

cd62d0580bea274125a50228ce2d64749fa02ff3
SHA256

20a3491a0c95f9594375effd26163dc2891b9b443164a74c8aad8a14966b1b54
SHA512

b1b76aea61bad37fab5dbe8100c9c64255f02dcc8765f1ec2f1721daf0f880c0b24032b26476ad2e78b4916dd2a49aabbe77db5435246243426d4415d9752f03
SSDEEP

49152:CpYDakpaKclyh9sXgoux+EjyDdXrAZ1nKPRbZnDvVu:PDaqnt/Qux+EjyDVQ1KJ1DNu

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  91246a1bcb2eacf617cc0094ac3bd9b0N.exe
- Size
  
  2.0MB
- MD5
  
  91246a1bcb2eacf617cc0094ac3bd9b0
- SHA1
  
  cd62d0580bea274125a50228ce2d64749fa02ff3
- SHA256
  
  20a3491a0c95f9594375effd26163dc2891b9b443164a74c8aad8a14966b1b54
- SHA512
  
  b1b76aea61bad37fab5dbe8100c9c64255f02dcc8765f1ec2f1721daf0f880c0b24032b26476ad2e78b4916dd2a49aabbe77db5435246243426d4415d9752f03
- SSDEEP
  
  49152:CpYDakpaKclyh9sXgoux+EjyDdXrAZ1nKPRbZnDvVu:PDaqnt/Qux+EjyDVQ1KJ1DNu
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer