c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503 | Triage

Sharing

General

Target

c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503
Size

72KB
Sample

240907-jmgpkashjj
MD5

096085650918102b001b3f9bb6b2078a
SHA1

2c3fc6d2cb302d86efa375794e5264dcd2c7c31e
SHA256

c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503
SHA512

749f67c236a863fe8c1e177bbc6b57c9fcdbb43603a6162697d4161420eca575f7f5e786196e33af0529401711e57b8f2a96c4bf94c0793b7a7548a1bd3df356
SSDEEP

1536:Ate+Zk7qzUJBC2KsgSMcJziyDfzHa/iSfRmq:Ate+aezUa6pBiyDfzhSfRb

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503
- Size
  
  72KB
- MD5
  
  096085650918102b001b3f9bb6b2078a
- SHA1
  
  2c3fc6d2cb302d86efa375794e5264dcd2c7c31e
- SHA256
  
  c21ef6c22f4d48dd72db3763e21e532af7510630e938c26db4bb3a0047f14503
- SHA512
  
  749f67c236a863fe8c1e177bbc6b57c9fcdbb43603a6162697d4161420eca575f7f5e786196e33af0529401711e57b8f2a96c4bf94c0793b7a7548a1bd3df356
- SSDEEP
  
  1536:Ate+Zk7qzUJBC2KsgSMcJziyDfzHa/iSfRmq:Ate+aezUa6pBiyDfzhSfRb
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer