537b724cbabb065a2e72b44c15555f2bcd8695994e5310771ee27d9917ff0c6e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6543e63e4e2b930538fa8a724c8d5940N.exe
Size

653KB
Sample

240906-cd1bzszejl
MD5

6543e63e4e2b930538fa8a724c8d5940
SHA1

60edf4f62c169b983600e6267f06ec67df2ea264
SHA256

537b724cbabb065a2e72b44c15555f2bcd8695994e5310771ee27d9917ff0c6e
SHA512

f5ec10a4ae3bd273d5eaf94ae09b2a6a9211faed38184b3a46faac44d429258d2595b4568748c049e4babcf41375a169cc5147bc595e326d1459035ef94e58a8
SSDEEP

12288:ZUG5TS6WSzRltqV2sLifBztVt1RHmQpZ74Uh67Hr56z6uWat/NJf/2cptkXgocEy:55TL9RK4sgzBbGQX7I

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Targets

- Target
  
  6543e63e4e2b930538fa8a724c8d5940N.exe
- Size
  
  653KB
- MD5
  
  6543e63e4e2b930538fa8a724c8d5940
- SHA1
  
  60edf4f62c169b983600e6267f06ec67df2ea264
- SHA256
  
  537b724cbabb065a2e72b44c15555f2bcd8695994e5310771ee27d9917ff0c6e
- SHA512
  
  f5ec10a4ae3bd273d5eaf94ae09b2a6a9211faed38184b3a46faac44d429258d2595b4568748c049e4babcf41375a169cc5147bc595e326d1459035ef94e58a8
- SSDEEP
  
  12288:ZUG5TS6WSzRltqV2sLifBztVt1RHmQpZ74Uh67Hr56z6uWat/NJf/2cptkXgocEy:55TL9RK4sgzBbGQX7I
Score

9^/10

discovery credential_access spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

credential_accessdiscoveryspywarestealer