960040ba2aac41fee79dad217936cde317ec2933b6fabef6123bed2ee4093f6b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cec5befa922fb9a052ea428d8190df80N.exe
Size

312KB
Sample

240912-pll6jsvcpc
MD5

cec5befa922fb9a052ea428d8190df80
SHA1

ff7f94b219eb8005626e1eef98721b3e2b970197
SHA256

960040ba2aac41fee79dad217936cde317ec2933b6fabef6123bed2ee4093f6b
SHA512

c0966f9ad60f8be4a5c38fc2d3386d9a04f1665d54cde8afd5479c6b23688f1d18d3bebb80dafac40437d52d15405d26b3ff92f58234624fde18bcd5c4ea0842
SSDEEP

6144:8PcNVrKRC0Z2GNMGQ+UMchieXtSKBHP4n/clwudjsT8S:FNcRC0YGNYzZhieXQhn6waITl

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  cec5befa922fb9a052ea428d8190df80N.exe
- Size
  
  312KB
- MD5
  
  cec5befa922fb9a052ea428d8190df80
- SHA1
  
  ff7f94b219eb8005626e1eef98721b3e2b970197
- SHA256
  
  960040ba2aac41fee79dad217936cde317ec2933b6fabef6123bed2ee4093f6b
- SHA512
  
  c0966f9ad60f8be4a5c38fc2d3386d9a04f1665d54cde8afd5479c6b23688f1d18d3bebb80dafac40437d52d15405d26b3ff92f58234624fde18bcd5c4ea0842
- SSDEEP
  
  6144:8PcNVrKRC0Z2GNMGQ+UMchieXtSKBHP4n/clwudjsT8S:FNcRC0YGNYzZhieXQhn6waITl
Score

7^/10

discovery spyware stealer persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoverypersistencespywarestealer