0ec487f880cd65fc30755475120791fc096eae6809dd6d138de0241969a8346b | Triage

Sharing

General

Target

989227e985cad6220db67c3bd9de6a78.zip
Size

46KB
Sample

240901-mpzvpsyfmc
MD5

7bff3b71a218f28ccff23b873c1bf6e3
SHA1

a351bccd6d0060724adaf9cac5a492cf0f21fd49
SHA256

0ec487f880cd65fc30755475120791fc096eae6809dd6d138de0241969a8346b
SHA512

bb60736076191a69a8e75e1e3e2a0c31903a81bd2f9ae198ec9bc1ae1e4756a301ff877b76f3bf6807c7f47e378840f35244b027777449465daa8e8dcc87410c
SSDEEP

768:Po8HZWYpDGQRBtsUpHS4cTw+p3nDXvdbKVIMMefaddAgj3g8cIze2r6v7u+Kd:QuHI6KUpHAx3nzdO6MX2dAgjg8P8K++

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  b3b9f2cbab4329d82b96f29f221071809c615a2797f82dfc3acb6c5049177f88
- Size
  
  78KB
- MD5
  
  989227e985cad6220db67c3bd9de6a78
- SHA1
  
  93ee9707c4dc3911303a9b23b375714fdbbb8601
- SHA256
  
  b3b9f2cbab4329d82b96f29f221071809c615a2797f82dfc3acb6c5049177f88
- SHA512
  
  712402b3c1448c9e097faf2ce6b8c5c8412c4b2910b53e4c32aee6ceb892fa200ae8f60eff979e0fb46aa42af20ef6f9498eea6c7a6dda643f5516eb40917544
- SSDEEP
  
  1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitNV9N+Mf1yUfw:qKtfDwsjPThTYszDH2fLV9N+c1u
Score

7^/10

discovery spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer