d916da24044f588dd0cc4ecf0ada77a095dcd6e0e2c87fbd6acd492b18d8d13d | Triage

Sharing

General

Target

d916da24044f588dd0cc4ecf0ada77a095dcd6e0e2c87fbd6acd492b18d8d13d
Size

393KB
Sample

240905-hpf1dawcrf
MD5

4fe2e76877cbd77bcc6ecec98a02b62c
SHA1

ffbe8cd3029976899756dbed3cd0ab76cbeb0bec
SHA256

d916da24044f588dd0cc4ecf0ada77a095dcd6e0e2c87fbd6acd492b18d8d13d
SHA512

b4966ece81787556ae5bf8d2b5f15d4f71c6bdb42576349809670883983176e7617e0c0a2de570dbe5c31087d3f56c6eeb4d6f9b1c857239013e7e22913b918e
SSDEEP

6144:G+aX3LWP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1mx:G+anahVy41

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  d916da24044f588dd0cc4ecf0ada77a095dcd6e0e2c87fbd6acd492b18d8d13d
- Size
  
  393KB
- MD5
  
  4fe2e76877cbd77bcc6ecec98a02b62c
- SHA1
  
  ffbe8cd3029976899756dbed3cd0ab76cbeb0bec
- SHA256
  
  d916da24044f588dd0cc4ecf0ada77a095dcd6e0e2c87fbd6acd492b18d8d13d
- SHA512
  
  b4966ece81787556ae5bf8d2b5f15d4f71c6bdb42576349809670883983176e7617e0c0a2de570dbe5c31087d3f56c6eeb4d6f9b1c857239013e7e22913b918e
- SSDEEP
  
  6144:G+aX3LWP2zPVz7jUBs8hqcBCi6dbfra4erJlt9A+xX1oOAisEIWmGeNkfGuYF1mx:G+anahVy41
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer