ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd | Triage

Sharing

General

Target

ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd
Size

264KB
Sample

240915-g98epazeqc
MD5

bff283f236fd6be1b1135fc2c7f3d896
SHA1

60549c51c4a916b17dd383aee52a7da569a17fea
SHA256

ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd
SHA512

bae6758847fd539a1a65e2ee7b0482afb4aac405a1477b98e55f36d81fc746350ddc209d4f981e0a95a58a3fac7aecaffcf6d1e5f46d4c2917c5630c0311cfbc
SSDEEP

1536:KXe+Zk78UKUWlILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uq:KXe+auLRkgUA1nQZwFGVO4Mqg+WDY

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd
- Size
  
  264KB
- MD5
  
  bff283f236fd6be1b1135fc2c7f3d896
- SHA1
  
  60549c51c4a916b17dd383aee52a7da569a17fea
- SHA256
  
  ecb38c0b5a1cfb15dcb3dd97615ae5aa0e2a53df54dab5c4808d9047373b2dbd
- SHA512
  
  bae6758847fd539a1a65e2ee7b0482afb4aac405a1477b98e55f36d81fc746350ddc209d4f981e0a95a58a3fac7aecaffcf6d1e5f46d4c2917c5630c0311cfbc
- SSDEEP
  
  1536:KXe+Zk78UKUWlILFkbeumIkA39xSZW175V7UZQJ0UjsWpcdVO4Mqg+aJRaCAd1uq:KXe+auLRkgUA1nQZwFGVO4Mqg+WDY
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer