351d00fbbcafe5ad3d7554f8fdd98edf4d38d7f766aa1f3563348e48c362078c | Triage

Sharing

General

Target

351d00fbbcafe5ad3d7554f8fdd98edf4d38d7f766aa1f3563348e48c362078c
Size

67KB
Sample

240921-r61wjsxfle
MD5

367c360837506fdd49baf5a17172410a
SHA1

79b4c47dd5e221e2302036f9ed68aa54d1b84eda
SHA256

351d00fbbcafe5ad3d7554f8fdd98edf4d38d7f766aa1f3563348e48c362078c
SHA512

cae3bd84e35d3af6367e4b2ff5cc647a1dc5dd0bd09ed248bb2ced35bb78aeb27c277f816e85cb7b712dc0f6706decacb47e11b547138dd9b572257302821cbe
SSDEEP

1536:2vaYzMXqtGNttyeiZnZLYm132kKzs2Irj5hN:2vaY46tGNttyeQLYm132kKzQj5r

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  351d00fbbcafe5ad3d7554f8fdd98edf4d38d7f766aa1f3563348e48c362078c
- Size
  
  67KB
- MD5
  
  367c360837506fdd49baf5a17172410a
- SHA1
  
  79b4c47dd5e221e2302036f9ed68aa54d1b84eda
- SHA256
  
  351d00fbbcafe5ad3d7554f8fdd98edf4d38d7f766aa1f3563348e48c362078c
- SHA512
  
  cae3bd84e35d3af6367e4b2ff5cc647a1dc5dd0bd09ed248bb2ced35bb78aeb27c277f816e85cb7b712dc0f6706decacb47e11b547138dd9b572257302821cbe
- SSDEEP
  
  1536:2vaYzMXqtGNttyeiZnZLYm132kKzs2Irj5hN:2vaY46tGNttyeQLYm132kKzQj5r
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer