388bd4292ed62796659d51afd0c69fb8542793182504c4f696e692c8ffb0321f | Triage

Sharing

General

Target

cfd61ea2bcc3c9a23f231bae53f8146d.zip
Size

43KB
Sample

240902-bq3r7sydjf
MD5

b68e396b768d0e763be0a27035defff5
SHA1

bc1d4682654b8f18e646861bb77365c89e7c424c
SHA256

388bd4292ed62796659d51afd0c69fb8542793182504c4f696e692c8ffb0321f
SHA512

f116de1e18a01fd6ce83a4027850ac8ec3626fc74c14a02c0eee02827b57c543ad76c17dcd429fedbadcd660fce405f47d661c144364f39993e7f7653b7f9ada
SSDEEP

768:WBOJSSvn/+f9L6m0wYTeyt7pxAFnqCiYxd3UvT/SK1rKngugt9FI2ju5Lm:W8JSSm9LZ0wYCG7b2qCiYn3UvTOguKzR

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  ed21af234022186ccc65c22880702d9b755628f27892056b94d936029464b09b
- Size
  
  72KB
- MD5
  
  cfd61ea2bcc3c9a23f231bae53f8146d
- SHA1
  
  cc9988b67245633d34bd61834aa0beb22f12ad7d
- SHA256
  
  ed21af234022186ccc65c22880702d9b755628f27892056b94d936029464b09b
- SHA512
  
  c3d5f9e4469836b4da776a483af4850c662c454d72848a8919cc19ccb59c01340e58b2f61e1b6b3986ed2c91d188d03d3d3e1dd9b8938cd85111e3061de513aa
- SSDEEP
  
  1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmit3F8w8adCG:qKtfDwsjPThTYszDH2fcwdB
Score

7^/10

discovery spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer