12d67136bded2d30c2504979641a5a2837355f15ca0051ab14ddf206672b3363 | Triage

Sharing

General

Target

d32eeea7b7feb512c5bf4354a1bbc180N
Size

434KB
Sample

240911-nbdkzsxalq
MD5

d32eeea7b7feb512c5bf4354a1bbc180
SHA1

f46c9c0731707fb0d7135fe1f9fd8b46f5507a25
SHA256

12d67136bded2d30c2504979641a5a2837355f15ca0051ab14ddf206672b3363
SHA512

9adf939ed8c9dc9fa32301e81c1e3249403cd218e626810e4c163cd647e8d72c57fd7c0fba0d622d0d14b8b1d06877a3abf36f344937ca33b49a21d06f21665f
SSDEEP

6144:sIbZAiwvyjrgHqHfd99RG1hOLMzGE9XNgShcHUa/KShcHU+UY:lyBcKAsOgivUa/KvU+UY

Score

8^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  d32eeea7b7feb512c5bf4354a1bbc180N
- Size
  
  434KB
- MD5
  
  d32eeea7b7feb512c5bf4354a1bbc180
- SHA1
  
  f46c9c0731707fb0d7135fe1f9fd8b46f5507a25
- SHA256
  
  12d67136bded2d30c2504979641a5a2837355f15ca0051ab14ddf206672b3363
- SHA512
  
  9adf939ed8c9dc9fa32301e81c1e3249403cd218e626810e4c163cd647e8d72c57fd7c0fba0d622d0d14b8b1d06877a3abf36f344937ca33b49a21d06f21665f
- SSDEEP
  
  6144:sIbZAiwvyjrgHqHfd99RG1hOLMzGE9XNgShcHUa/KShcHU+UY:lyBcKAsOgivUa/KvU+UY
Score

8^/10

discovery evasion persistence spyware stealer
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2

discoveryevasionpersistencespywarestealer