173183ff32fdd8ebd3961d48c46c43697459966cf4cf5f2a2bc5b0f67a8c2a9c | Triage

Sharing

General

Target

173183ff32fdd8ebd3961d48c46c43697459966cf4cf5f2a2bc5b0f67a8c2a9c
Size

306KB
Sample

240909-qbjhca1gnf
MD5

7b06cc872e4bc3fcec53a617f10b5c3b
SHA1

67e0fa555780fd3384afa0a46e239525e5570db9
SHA256

173183ff32fdd8ebd3961d48c46c43697459966cf4cf5f2a2bc5b0f67a8c2a9c
SHA512

5a354db7ca71f4efa4f24f184ce94f2c17302e5dec1f552bc030f7f1c46ed3eb468a63c1b5f83e8fea8a04c248e5775fa38c4f7562927e37222385b515715c80
SSDEEP

6144:Tl+ayObiZKDAX0jH0o2zq9DmQ3LOotL4gr:Tl+a3biZKm4H8zq9Fjtdr

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  173183ff32fdd8ebd3961d48c46c43697459966cf4cf5f2a2bc5b0f67a8c2a9c
- Size
  
  306KB
- MD5
  
  7b06cc872e4bc3fcec53a617f10b5c3b
- SHA1
  
  67e0fa555780fd3384afa0a46e239525e5570db9
- SHA256
  
  173183ff32fdd8ebd3961d48c46c43697459966cf4cf5f2a2bc5b0f67a8c2a9c
- SHA512
  
  5a354db7ca71f4efa4f24f184ce94f2c17302e5dec1f552bc030f7f1c46ed3eb468a63c1b5f83e8fea8a04c248e5775fa38c4f7562927e37222385b515715c80
- SSDEEP
  
  6144:Tl+ayObiZKDAX0jH0o2zq9DmQ3LOotL4gr:Tl+a3biZKm4H8zq9Fjtdr
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer