96c1eccc30764a57301b3577ca8befda333174cd14eda6562344987585983872 | Triage

Sharing

General

Target

96c1eccc30764a57301b3577ca8befda333174cd14eda6562344987585983872
Size

2.8MB
Sample

240914-srj5xs1ajn
MD5

e6c2e04d19d1e3bb6c9328c4818166dd
SHA1

fe820813cf5ffc8b32f727fbd026856e2af665c9
SHA256

96c1eccc30764a57301b3577ca8befda333174cd14eda6562344987585983872
SHA512

c0f594ff2a1120f87518802b39e482e8611dfe371ba0be7fbcd41c5423ec73117e527c6920744f9ce0c673a4f0a44c7324fc8054774613917595557ee9582a04
SSDEEP

12288:vj7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7:/cX

Score

10^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  96c1eccc30764a57301b3577ca8befda333174cd14eda6562344987585983872
- Size
  
  2.8MB
- MD5
  
  e6c2e04d19d1e3bb6c9328c4818166dd
- SHA1
  
  fe820813cf5ffc8b32f727fbd026856e2af665c9
- SHA256
  
  96c1eccc30764a57301b3577ca8befda333174cd14eda6562344987585983872
- SHA512
  
  c0f594ff2a1120f87518802b39e482e8611dfe371ba0be7fbcd41c5423ec73117e527c6920744f9ce0c673a4f0a44c7324fc8054774613917595557ee9582a04
- SSDEEP
  
  12288:vj7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7:/cX
Score

10^/10

discovery evasion persistence spyware stealer
- Modifies visibility of file extensions in Explorer
  evasion
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencespywarestealer

behavioral2

discoveryevasionpersistencespywarestealer