c41fc802d670ffdc49bfe7fc6daa0fe8344255c6db533439133a412c45b8119e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c41fc802d670ffdc49bfe7fc6daa0fe8344255c6db533439133a412c45b8119e
Size

3.6MB
Sample

241009-djtl3ascjc
MD5

87ead3f52d6bd83599431c1581fbb688
SHA1

7b715f25695859f370c5101ac36dc15c086244d3
SHA256

c41fc802d670ffdc49bfe7fc6daa0fe8344255c6db533439133a412c45b8119e
SHA512

5c396ab2d3219d1c86edef770403041fc4f8ddf0f30118d41e45f2525e050c46e11d26ce3e6d1f8a862421534f238ec898aa4722d0c8bf7fe789da6a5ee5b232
SSDEEP

49152:t23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7V:jbm71OxRR9Sl1xB

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  c41fc802d670ffdc49bfe7fc6daa0fe8344255c6db533439133a412c45b8119e
- Size
  
  3.6MB
- MD5
  
  87ead3f52d6bd83599431c1581fbb688
- SHA1
  
  7b715f25695859f370c5101ac36dc15c086244d3
- SHA256
  
  c41fc802d670ffdc49bfe7fc6daa0fe8344255c6db533439133a412c45b8119e
- SHA512
  
  5c396ab2d3219d1c86edef770403041fc4f8ddf0f30118d41e45f2525e050c46e11d26ce3e6d1f8a862421534f238ec898aa4722d0c8bf7fe789da6a5ee5b232
- SSDEEP
  
  49152:t23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7V:jbm71OxRR9Sl1xB
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer