cfa93fc8baf5c7f34710bf5f0fe8210a4dbf65af0dcfa2373db60a250b829998 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfa93fc8baf5c7f34710bf5f0fe8210a4dbf65af0dcfa2373db60a250b829998N
Size

110KB
Sample

240921-mjy18axelg
MD5

b69a594336ff348433fa3a69e3939580
SHA1

fbc48a204101f100a8b3430e81b58a465898378f
SHA256

cfa93fc8baf5c7f34710bf5f0fe8210a4dbf65af0dcfa2373db60a250b829998
SHA512

38445cfbf38cd017b878e80566c3823ad35c881caf9bb7522da50cb10b627e5ce3cc2d7dc432fcf04bd6e486ae0c820633be6eb8e844ea4df3e6dc55a91df3ab
SSDEEP

3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQOO7GQv5AQDc2:GjYKlAhUBVB3pQOidrc2

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  cfa93fc8baf5c7f34710bf5f0fe8210a4dbf65af0dcfa2373db60a250b829998N
- Size
  
  110KB
- MD5
  
  b69a594336ff348433fa3a69e3939580
- SHA1
  
  fbc48a204101f100a8b3430e81b58a465898378f
- SHA256
  
  cfa93fc8baf5c7f34710bf5f0fe8210a4dbf65af0dcfa2373db60a250b829998
- SHA512
  
  38445cfbf38cd017b878e80566c3823ad35c881caf9bb7522da50cb10b627e5ce3cc2d7dc432fcf04bd6e486ae0c820633be6eb8e844ea4df3e6dc55a91df3ab
- SSDEEP
  
  3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQOO7GQv5AQDc2:GjYKlAhUBVB3pQOidrc2
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer