94bb480ccd9757d38cf66db3b7681d5e3c93d937c5a45a73cb53cda19afbfe41 | Triage

Sharing

General

Target

94bb480ccd9757d38cf66db3b7681d5e3c93d937c5a45a73cb53cda19afbfe41N
Size

110KB
Sample

240919-ezkjrs1bka
MD5

83a59f3c895c7f5ef9af019776bc3660
SHA1

2975f791417a3f6bc7181933b42923bf1a0e13b7
SHA256

94bb480ccd9757d38cf66db3b7681d5e3c93d937c5a45a73cb53cda19afbfe41
SHA512

bdfb657dd69220b382024486b95d7797752eb1b7b50985c0b5a6db3b1d884d6db48d73bdde5c5226d4636f69fee2c8727bf4eeaacd5e03b038017391bb337803
SSDEEP

3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQO0X5oNGE+rmaz:GjYKlAhUBVB3pQOw5sGE+rP

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  94bb480ccd9757d38cf66db3b7681d5e3c93d937c5a45a73cb53cda19afbfe41N
- Size
  
  110KB
- MD5
  
  83a59f3c895c7f5ef9af019776bc3660
- SHA1
  
  2975f791417a3f6bc7181933b42923bf1a0e13b7
- SHA256
  
  94bb480ccd9757d38cf66db3b7681d5e3c93d937c5a45a73cb53cda19afbfe41
- SHA512
  
  bdfb657dd69220b382024486b95d7797752eb1b7b50985c0b5a6db3b1d884d6db48d73bdde5c5226d4636f69fee2c8727bf4eeaacd5e03b038017391bb337803
- SSDEEP
  
  3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQO0X5oNGE+rmaz:GjYKlAhUBVB3pQOw5sGE+rP
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer