b7ecdfadb8193e0d4c39470023e5b0bf8bf3b9e46396bc6a4b2ce16cef85806f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b7ecdfadb8193e0d4c39470023e5b0bf8bf3b9e46396bc6a4b2ce16cef85806f
Size

366KB
Sample

240921-qry8qsvblb
MD5

d33b240188a947964eece0e096f5655a
SHA1

c94136b07b37e8c6d626bc6ca321110666eb6cec
SHA256

b7ecdfadb8193e0d4c39470023e5b0bf8bf3b9e46396bc6a4b2ce16cef85806f
SHA512

05e3e10f3fd5d13c03b6a0018658a3b9ceefe6857a6f4ef3b0e191372ee1138c07efff02dc88a50a94852f9f4b0a3b8e9e208a1c41cf4b487d0be7a93afb9935
SSDEEP

6144:F+aTCH9L5d5ezLqIFQSDdABbSbIrx1L1l3ERF:F+aTCH9Eq+0BbSox1QF

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  b7ecdfadb8193e0d4c39470023e5b0bf8bf3b9e46396bc6a4b2ce16cef85806f
- Size
  
  366KB
- MD5
  
  d33b240188a947964eece0e096f5655a
- SHA1
  
  c94136b07b37e8c6d626bc6ca321110666eb6cec
- SHA256
  
  b7ecdfadb8193e0d4c39470023e5b0bf8bf3b9e46396bc6a4b2ce16cef85806f
- SHA512
  
  05e3e10f3fd5d13c03b6a0018658a3b9ceefe6857a6f4ef3b0e191372ee1138c07efff02dc88a50a94852f9f4b0a3b8e9e208a1c41cf4b487d0be7a93afb9935
- SSDEEP
  
  6144:F+aTCH9L5d5ezLqIFQSDdABbSbIrx1L1l3ERF:F+aTCH9Eq+0BbSox1QF
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer