ca4f3cd705baec75708e1cd82bd35af079ef0e0dc795dd6b53b1c4bca6d40dd7 | Triage

Sharing

General

Target

ca4f3cd705baec75708e1cd82bd35af079ef0e0dc795dd6b53b1c4bca6d40dd7N
Size

1.3MB
Sample

240919-dd779sxepp
MD5

90bdd8e3a2fa5b044c43f4643dfe4c30
SHA1

ef75c3dcf6caee15b949e73530d5d3d8d56cf725
SHA256

ca4f3cd705baec75708e1cd82bd35af079ef0e0dc795dd6b53b1c4bca6d40dd7
SHA512

9f59f1528297e18304e58d836bc8bebab18431590b429ff3248031ba618c0f15cc551ca40a6978a65f421ad4502ca96ffe226eed186b50736cbf725b82f7fdf5
SSDEEP

24576:oWy3HMD+LyxcIRGkIPuyW1+gyhRTp6WIpNSq9+9mrdRX7AYUpcldAOLn:Vy3HMCWx6mmJEZn9+96tUp0zLn

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  ca4f3cd705baec75708e1cd82bd35af079ef0e0dc795dd6b53b1c4bca6d40dd7N
- Size
  
  1.3MB
- MD5
  
  90bdd8e3a2fa5b044c43f4643dfe4c30
- SHA1
  
  ef75c3dcf6caee15b949e73530d5d3d8d56cf725
- SHA256
  
  ca4f3cd705baec75708e1cd82bd35af079ef0e0dc795dd6b53b1c4bca6d40dd7
- SHA512
  
  9f59f1528297e18304e58d836bc8bebab18431590b429ff3248031ba618c0f15cc551ca40a6978a65f421ad4502ca96ffe226eed186b50736cbf725b82f7fdf5
- SSDEEP
  
  24576:oWy3HMD+LyxcIRGkIPuyW1+gyhRTp6WIpNSq9+9mrdRX7AYUpcldAOLn:Vy3HMCWx6mmJEZn9+96tUp0zLn
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer