af4090144e3ba6900af06c077663f379cd8eba5844718b10553f99e67e479f66 | Triage

Sharing

General

Target

FusionAutoExecOnTSB.exe
Size

16.8MB
Sample

241013-mh5sdawgnj
MD5

fa760e085c2e7ee00e5674837187e7c9
SHA1

b706c67da08ae9c57db0c92704044ddb802fcd4d
SHA256

af4090144e3ba6900af06c077663f379cd8eba5844718b10553f99e67e479f66
SHA512

e494af589a16bfd4600d56afeb0da7b37de48179178cc2a6e9583086b4986ed092b7ccaa769cf7955c6e42c35d62b8131e7f4fd27dbfbbc4792ca404b1d16991
SSDEEP

393216:pXb4YQhZ2YsHFUK2Jn1+TtIiFmY9Z8D8CclDNQhVCUTbmQLoSsF:RQZ2YwUlJn1QtI3a8DZcBojHL

Score

7^/10

discovery persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  FusionAutoExecOnTSB.exe
- Size
  
  16.8MB
- MD5
  
  fa760e085c2e7ee00e5674837187e7c9
- SHA1
  
  b706c67da08ae9c57db0c92704044ddb802fcd4d
- SHA256
  
  af4090144e3ba6900af06c077663f379cd8eba5844718b10553f99e67e479f66
- SHA512
  
  e494af589a16bfd4600d56afeb0da7b37de48179178cc2a6e9583086b4986ed092b7ccaa769cf7955c6e42c35d62b8131e7f4fd27dbfbbc4792ca404b1d16991
- SSDEEP
  
  393216:pXb4YQhZ2YsHFUK2Jn1+TtIiFmY9Z8D8CclDNQhVCUTbmQLoSsF:RQZ2YwUlJn1QtI3a8DZcBojHL
Score

7^/10

discovery persistence privilege_escalation spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistenceprivilege_escalationspywarestealer