29ec28b541b8a3fa310eaf97e9bd3c4a43a1e8dd93814255f3da8d32fb651204 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29ec28b541b8a3fa310eaf97e9bd3c4a43a1e8dd93814255f3da8d32fb651204
Size

761KB
Sample

240909-qyvtws1bnr
MD5

721be930c45d7bee226f8e8e326d6b6b
SHA1

53b405f53e159143483ae5c02712d910f58f3d8a
SHA256

29ec28b541b8a3fa310eaf97e9bd3c4a43a1e8dd93814255f3da8d32fb651204
SHA512

22cf8b5d7b9b38f4f86e38733f4c4fb20573a037127a912c3c7fa4f3b3c2855e657fe13a9172bd661804a8a40142fac586ddb815c4870d5ba1a8f7abbbb2e1f7
SSDEEP

12288:Tl+aFGboup+VHKBX3jbgS/Wg0MIn7ou8XBKsHKZycUQUfXJvA:pBF2kHKlzcS/0MInsu8uZycUfvA

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  29ec28b541b8a3fa310eaf97e9bd3c4a43a1e8dd93814255f3da8d32fb651204
- Size
  
  761KB
- MD5
  
  721be930c45d7bee226f8e8e326d6b6b
- SHA1
  
  53b405f53e159143483ae5c02712d910f58f3d8a
- SHA256
  
  29ec28b541b8a3fa310eaf97e9bd3c4a43a1e8dd93814255f3da8d32fb651204
- SHA512
  
  22cf8b5d7b9b38f4f86e38733f4c4fb20573a037127a912c3c7fa4f3b3c2855e657fe13a9172bd661804a8a40142fac586ddb815c4870d5ba1a8f7abbbb2e1f7
- SSDEEP
  
  12288:Tl+aFGboup+VHKBX3jbgS/Wg0MIn7ou8XBKsHKZycUQUfXJvA:pBF2kHKlzcS/0MInsu8uZycUfvA
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer