359ccbf0e462985fec7ac0c22317e0317a2cb2e975d0adf36a5f0615800945a9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

359ccbf0e462985fec7ac0c22317e0317a2cb2e975d0adf36a5f0615800945a9
Size

56KB
Sample

241012-k41pfaxflm
MD5

81fb704470d89a2c7818dc28bf730476
SHA1

e255822c9f49d0068f0f95461a8b5e263f9df314
SHA256

359ccbf0e462985fec7ac0c22317e0317a2cb2e975d0adf36a5f0615800945a9
SHA512

36693f54179295a480cf01bd66cec0e0fab7f363b741e605ac9f6b5d1c81b79af4e126023935fd1ff871b0517e7942ca5aa3521d125dcd09b6007acb7923798a
SSDEEP

768:SZetyBpQFJFKZj1PVs9Ag1vzbaBrOF32zzFF+OtTDMmgqgt6jpYU5ltbDrYiI0oq:Skcx1aeg1viBxvCOt3+6jWWvr78Pxc

Score

7^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  359ccbf0e462985fec7ac0c22317e0317a2cb2e975d0adf36a5f0615800945a9
- Size
  
  56KB
- MD5
  
  81fb704470d89a2c7818dc28bf730476
- SHA1
  
  e255822c9f49d0068f0f95461a8b5e263f9df314
- SHA256
  
  359ccbf0e462985fec7ac0c22317e0317a2cb2e975d0adf36a5f0615800945a9
- SHA512
  
  36693f54179295a480cf01bd66cec0e0fab7f363b741e605ac9f6b5d1c81b79af4e126023935fd1ff871b0517e7942ca5aa3521d125dcd09b6007acb7923798a
- SSDEEP
  
  768:SZetyBpQFJFKZj1PVs9Ag1vzbaBrOF32zzFF+OtTDMmgqgt6jpYU5ltbDrYiI0oq:Skcx1aeg1viBxvCOt3+6jWWvr78Pxc
Score

7^/10

discovery spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer