abf0e9668be534009afc5c924628129a84da8c86ea3913d8c4e22aa88d2d148b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c6d98e74bbbc7e2b2487b53f52b817b0N.exe
Size

577KB
Sample

240904-lrlv7ayhmb
MD5

c6d98e74bbbc7e2b2487b53f52b817b0
SHA1

6e9e7bbca5e0c4cb749a874edb42bacd536d241e
SHA256

abf0e9668be534009afc5c924628129a84da8c86ea3913d8c4e22aa88d2d148b
SHA512

1d381d2f556fb67a908a6cb1a8285242c215e556865c78b9d84eccb247850c7964fbcd7c17d8eadb187e1e9bbfb265dca4ea0ad401864d500be47bd7e42ae2a2
SSDEEP

6144:ul46tGdyWE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0G:ul3Nt7a3iwbihym2g7XO3LWUQfh4Co

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c6d98e74bbbc7e2b2487b53f52b817b0N.exe
- Size
  
  577KB
- MD5
  
  c6d98e74bbbc7e2b2487b53f52b817b0
- SHA1
  
  6e9e7bbca5e0c4cb749a874edb42bacd536d241e
- SHA256
  
  abf0e9668be534009afc5c924628129a84da8c86ea3913d8c4e22aa88d2d148b
- SHA512
  
  1d381d2f556fb67a908a6cb1a8285242c215e556865c78b9d84eccb247850c7964fbcd7c17d8eadb187e1e9bbfb265dca4ea0ad401864d500be47bd7e42ae2a2
- SSDEEP
  
  6144:ul46tGdyWE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0G:ul3Nt7a3iwbihym2g7XO3LWUQfh4Co
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer