c1da96a5004b1572bfd413bbd8007d02616a3a3ac48df8fa3fb1e00578d96ecf | Triage

Sharing

General

Target

c1da96a5004b1572bfd413bbd8007d02616a3a3ac48df8fa3fb1e00578d96ecf
Size

3.1MB
Sample

240826-ab2e6ashle
MD5

89ce37327620afad643bc87639bf61cd
SHA1

c6513df6f6e45871dc3d457a119f4e4c8d2d6080
SHA256

c1da96a5004b1572bfd413bbd8007d02616a3a3ac48df8fa3fb1e00578d96ecf
SHA512

c07977524d31671b6df2042f996e0ba64d9ea323a7b95163f13923aff0200aacdb272007404719e1011529942092becaa2e1ada194927cfd9f3a5e83a77c9b18
SSDEEP

49152:aVAbwWYb12jHSVaHO3Vg3gfRv9yuqohghbpVOpmV4w1Z6nPI4gyJv:uAJY5oHhb0FqWgFQlw2w4gG

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c1da96a5004b1572bfd413bbd8007d02616a3a3ac48df8fa3fb1e00578d96ecf
- Size
  
  3.1MB
- MD5
  
  89ce37327620afad643bc87639bf61cd
- SHA1
  
  c6513df6f6e45871dc3d457a119f4e4c8d2d6080
- SHA256
  
  c1da96a5004b1572bfd413bbd8007d02616a3a3ac48df8fa3fb1e00578d96ecf
- SHA512
  
  c07977524d31671b6df2042f996e0ba64d9ea323a7b95163f13923aff0200aacdb272007404719e1011529942092becaa2e1ada194927cfd9f3a5e83a77c9b18
- SSDEEP
  
  49152:aVAbwWYb12jHSVaHO3Vg3gfRv9yuqohghbpVOpmV4w1Z6nPI4gyJv:uAJY5oHhb0FqWgFQlw2w4gG
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryspywarestealer