ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
Size

138KB
Sample

241009-clb95axaqd
MD5

1f0116315b4d88e64c547b066e72dda2
SHA1

8cb6479225564ec4165295e34abb89cbbc6b20ee
SHA256

ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
SHA512

a55e70064101f08cdbd2d0ea9f49e69d049cef536f1806c5633806b75093e404bf9214e1867af7145b25e0bb8cb0cf9dcd4693bf1ca16ab0e311cb11a3c6d909
SSDEEP

3072:oc5+bBl3E2df1PdolVR5huqWmnZf0iCd8ke183czW3sKcNUdHKd+Nv50fJcQ5nmF:oc5+Vl3E8xdolxv95KpHM+NQXrq

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
- Size
  
  138KB
- MD5
  
  1f0116315b4d88e64c547b066e72dda2
- SHA1
  
  8cb6479225564ec4165295e34abb89cbbc6b20ee
- SHA256
  
  ac625d190cb48de0c6184a5d4bf9a2e9fc4d04d8eb77fe7f83120f473e8df953
- SHA512
  
  a55e70064101f08cdbd2d0ea9f49e69d049cef536f1806c5633806b75093e404bf9214e1867af7145b25e0bb8cb0cf9dcd4693bf1ca16ab0e311cb11a3c6d909
- SSDEEP
  
  3072:oc5+bBl3E2df1PdolVR5huqWmnZf0iCd8ke183czW3sKcNUdHKd+Nv50fJcQ5nmF:oc5+Vl3E8xdolxv95KpHM+NQXrq
Score

7^/10

discovery persistence spyware stealer
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2