936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9 | Triage

Sharing

General

Target

936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9
Size

101KB
Sample

240914-aaawtaxaje
MD5

7ad6e95ed44ec9b92db8ea11d53a62e2
SHA1

d321ff9146b53b05a1a6be41f4f565f32f6a9168
SHA256

936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9
SHA512

bd7b6fe8741e979250f83d139df95382cbefa0a9b0c4a3a9a43aa0ea20afb24fa9089392e6add6658278ad936f667b261f46da2d116d291d2f250eddae010bc2
SSDEEP

1536:2Rpsrz8GvnGYWtwXaa8NPI9j+RedcP01ic4Brg:2i8aTWtwXwKRj1EBrg

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9
- Size
  
  101KB
- MD5
  
  7ad6e95ed44ec9b92db8ea11d53a62e2
- SHA1
  
  d321ff9146b53b05a1a6be41f4f565f32f6a9168
- SHA256
  
  936ef75de2ffa46641142f0d44fe462425eacc11458ef4e2e943661e4a485de9
- SHA512
  
  bd7b6fe8741e979250f83d139df95382cbefa0a9b0c4a3a9a43aa0ea20afb24fa9089392e6add6658278ad936f667b261f46da2d116d291d2f250eddae010bc2
- SSDEEP
  
  1536:2Rpsrz8GvnGYWtwXaa8NPI9j+RedcP01ic4Brg:2i8aTWtwXwKRj1EBrg
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer