59441ca951108c5ff13a32573ba85c4a0a2720f60e41e80fc0984fbf8d24e8aa | Triage

Sharing

General

Target

3f88e4466cf3ce4d19113304b28f78f4.zip
Size

448KB
Sample

240901-kx3v8awfmq
MD5

80655c081f2fe4ffd831bfcc2fb83bb2
SHA1

49594e09dae0c82045462b598d5430edb2776d88
SHA256

59441ca951108c5ff13a32573ba85c4a0a2720f60e41e80fc0984fbf8d24e8aa
SHA512

85394d871f8195c71fc9543441fef4e02dfde594ea6acb54138f08a3360ee9f2c5c2482a077c0cde95fe8fa885624985ff88b3e0791e8cd98d07440baac3e966
SSDEEP

12288:7BdefwuCAGvN0M13d3b6ZYZE0L1D/1crkPhJYGEpicC/C:7BIfwuCAGlb13dLz/1crkPhd/C

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  3673c4e11b206790d884eedcaced0e58d19bf08b6554c8df64725aba2573240e
- Size
  
  919KB
- MD5
  
  3f88e4466cf3ce4d19113304b28f78f4
- SHA1
  
  d6ed629b26e37f138ae62511338be903f4ebdb86
- SHA256
  
  3673c4e11b206790d884eedcaced0e58d19bf08b6554c8df64725aba2573240e
- SHA512
  
  3827993b1e9a0fb15e02369947b026812069453733f913b01be33202422d17535c98f6635c93ae5b275924ca1b4f87d1e711d7be9e4e5d43eb39cf2342fe1069
- SSDEEP
  
  12288:8uPUTLYcAaUMhUhLupXshh1PEd5hOoXpJePfqw6gmQNhxAoRYn:8uPmLDUMihIXCE5Fi76gxh8
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer