dd645e4b53258ed82a06056bc9259e35587dbb5693b169b9b20860358165ca27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd645e4b53258ed82a06056bc9259e35587dbb5693b169b9b20860358165ca27
Size

97KB
Sample

240921-r8tv1sxgkc
MD5

74a3ab190fc7935f9eeb9794ac0861b4
SHA1

c7a95801d632be087cbb4c3a9596a91a54421c3c
SHA256

dd645e4b53258ed82a06056bc9259e35587dbb5693b169b9b20860358165ca27
SHA512

cb13ef658d85ad5de4f3e0b5c62992bcf45393fbfc0fc5c0228637c86b38ff74f06e9e39c37dfbab0dcf48ae26ecee95445d690bf19dd5c23aec9945d0627852
SSDEEP

1536:xHe+Zk77RNYjLBcae2/sDf88qP2CsRdxgwGGCIOunToIfiWdN:xHe+aX38yawf8l2CHRGgKTBfik

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  dd645e4b53258ed82a06056bc9259e35587dbb5693b169b9b20860358165ca27
- Size
  
  97KB
- MD5
  
  74a3ab190fc7935f9eeb9794ac0861b4
- SHA1
  
  c7a95801d632be087cbb4c3a9596a91a54421c3c
- SHA256
  
  dd645e4b53258ed82a06056bc9259e35587dbb5693b169b9b20860358165ca27
- SHA512
  
  cb13ef658d85ad5de4f3e0b5c62992bcf45393fbfc0fc5c0228637c86b38ff74f06e9e39c37dfbab0dcf48ae26ecee95445d690bf19dd5c23aec9945d0627852
- SSDEEP
  
  1536:xHe+Zk77RNYjLBcae2/sDf88qP2CsRdxgwGGCIOunToIfiWdN:xHe+aX38yawf8l2CHRGgKTBfik
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer