691b60989839be8e276a256f15609de205d5fcec4215a3382806110348be7dc3 | Triage

Sharing

General

Target

691b60989839be8e276a256f15609de205d5fcec4215a3382806110348be7dc3
Size

2.7MB
Sample

240920-wzdvnazhjf
MD5

e80b5d6fb28284211542354b55af2e98
SHA1

3f3c0531c1dd664951bcc610f391c6ed85d47e31
SHA256

691b60989839be8e276a256f15609de205d5fcec4215a3382806110348be7dc3
SHA512

a0ef807133f9b2f9dbc4e239588cacd0674cb9d87613fd9af62eebf98703ac9761115a1be64ba0a72bf3f6539e41732117e4938d77b1db36e86c6f30d618721d
SSDEEP

12288:vj7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7Y:3cX

Score

10^/10

discovery evasion persistence spyware stealer

Malware Config

Targets

- Target
  
  691b60989839be8e276a256f15609de205d5fcec4215a3382806110348be7dc3
- Size
  
  2.7MB
- MD5
  
  e80b5d6fb28284211542354b55af2e98
- SHA1
  
  3f3c0531c1dd664951bcc610f391c6ed85d47e31
- SHA256
  
  691b60989839be8e276a256f15609de205d5fcec4215a3382806110348be7dc3
- SHA512
  
  a0ef807133f9b2f9dbc4e239588cacd0674cb9d87613fd9af62eebf98703ac9761115a1be64ba0a72bf3f6539e41732117e4938d77b1db36e86c6f30d618721d
- SSDEEP
  
  12288:vj7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7j7Y:3cX
Score

10^/10

discovery evasion persistence spyware stealer
- Modifies visibility of file extensions in Explorer
  evasion
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistencespywarestealer