a8370bd41f53c01d736da6fecd4d4eb89e17925ca3e8e3c555b7a722c5f1ac70 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9b21e3cfe485a4dacffe2f6ea49a1e54.zip
Size

199KB
Sample

240901-hfjpxavbqc
MD5

7016899e6baa098421447eb39afdd049
SHA1

596fba04977c36bd6bfc9848f4fbbc9cd5bcb29a
SHA256

a8370bd41f53c01d736da6fecd4d4eb89e17925ca3e8e3c555b7a722c5f1ac70
SHA512

819c4a9e4ba037b9ca92a80a37c9767fab5e368cca5485c571493d6cac0d946f39d7e38b5a1d7d1e3da9351581e4a510d11f20d0c591abbdb290371de21a999a
SSDEEP

3072:7MWuK3lAywJjyRzFKtf3iJX8J5/Eiy30yqe60KIZ4DUGIZDowV9uFWRke+dINfSd:7D93lAXByRwAJ4Elk7LlKowHukt+d/

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  bb5088d34afa36ee682138aed8f1d96268ef4c736b27fa06325c881efc0d267a
- Size
  
  384KB
- MD5
  
  9b21e3cfe485a4dacffe2f6ea49a1e54
- SHA1
  
  36a167a5cb77fb241a47c11aec1f8b2f390bd262
- SHA256
  
  bb5088d34afa36ee682138aed8f1d96268ef4c736b27fa06325c881efc0d267a
- SHA512
  
  5927cb44fe4bb2586a29e5a628618a132e330232d1fe0c72b99994cabff776b70191b80779cae28418bed13045001e7824fa7669a59b81d5c0505ea88e67fe32
- SSDEEP
  
  6144:BtfDwsjPThT5zL27EJ5rX6GgcmDsL0vrxFsoAhnOkyiz53aJWTBP0tFwMYPgLESN:B5hVzPrXOcmFFgOkyU532WTh0tFhfa3G
Score

7^/10

discovery spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer