75196f1b6e910108d8c56a6d0be12a2eca12903829c2197d18f16e0291484f36 | Triage

Resubmissions

09/10/2024, 10:00

241009-l1mtvaxcll 7

09/10/2024, 09:17

241009-k82gjaxeka 7

Sharing

General

Target

Notification_of_Salary_Reduction_of_2000_Rupees.rar
Size

354KB
Sample

241009-k82gjaxeka
MD5

9494a6a1b16af8d8b112eb50dba615a3
SHA1

09679d266daf9eb330c104f0a1d3a000e5b1b50a
SHA256

75196f1b6e910108d8c56a6d0be12a2eca12903829c2197d18f16e0291484f36
SHA512

19fcfec0f023ae2aa10d03c9bb673980ba58b2b6ed903a32473b825fcb67b2dfbb2af182ed6abbb06f2fcf898cfaec92bd0c89c8d5e8a4e7dc490e352dcce62d
SSDEEP

6144:sy4zNpA3wRAtDlNRR7yUEzLu/SAI8vxlF5K5Hcnyi7iROB37GM47hcyeF5w93yxp:yw3eIICzIyxlqHcnyi7wu9yeF5yCQWso

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  Notification_of_Salary_Reduction_of_2000_Rupees.rar
- Size
  
  354KB
- MD5
  
  9494a6a1b16af8d8b112eb50dba615a3
- SHA1
  
  09679d266daf9eb330c104f0a1d3a000e5b1b50a
- SHA256
  
  75196f1b6e910108d8c56a6d0be12a2eca12903829c2197d18f16e0291484f36
- SHA512
  
  19fcfec0f023ae2aa10d03c9bb673980ba58b2b6ed903a32473b825fcb67b2dfbb2af182ed6abbb06f2fcf898cfaec92bd0c89c8d5e8a4e7dc490e352dcce62d
- SSDEEP
  
  6144:sy4zNpA3wRAtDlNRR7yUEzLu/SAI8vxlF5K5Hcnyi7iROB37GM47hcyeF5w93yxp:yw3eIICzIyxlqHcnyi7wu9yeF5yCQWso
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer