ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f | Triage

Sharing

General

Target

ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f
Size

1.5MB
Sample

240914-n1hagasbpq
MD5

73242577c27ba46a1e13320688156b53
SHA1

bc3027a78a791d2ed371e96293dfb4af8060893b
SHA256

ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f
SHA512

f19216a9a496b17f6455001b0f1c2daf0acfcd4533a7ed171a8619613538f4d50090f81001accc2bdcf463e3cbda91ebd9628e8484d422141e1eca09f06a2fda
SSDEEP

24576:38KLbnHzGSbHFukT8Mle7q7LLS/85RkVtxjsE9DzIQtZW:380TG8FukT80eULSUfkV7j

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Targets

- Target
  
  ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f
- Size
  
  1.5MB
- MD5
  
  73242577c27ba46a1e13320688156b53
- SHA1
  
  bc3027a78a791d2ed371e96293dfb4af8060893b
- SHA256
  
  ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f
- SHA512
  
  f19216a9a496b17f6455001b0f1c2daf0acfcd4533a7ed171a8619613538f4d50090f81001accc2bdcf463e3cbda91ebd9628e8484d422141e1eca09f06a2fda
- SSDEEP
  
  24576:38KLbnHzGSbHFukT8Mle7q7LLS/85RkVtxjsE9DzIQtZW:380TG8FukT80eULSUfkV7j
Score

9^/10

credential_access discovery spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoveryspywarestealer

behavioral2

credential_accessdiscoveryspywarestealer