93f7f9d40d51255da50dd355c4be6c622961412b9ad36ff6039dd7e76b465b6d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

93f7f9d40d51255da50dd355c4be6c622961412b9ad36ff6039dd7e76b465b6d
Size

2.6MB
Sample

241018-bah3vswgng
MD5

2c871e3cfcf9f09145fd7bfcc79fd223
SHA1

62d7b02b6a07910e5880971594b6b6260ef0417c
SHA256

93f7f9d40d51255da50dd355c4be6c622961412b9ad36ff6039dd7e76b465b6d
SHA512

36d1c0d09dcb8032f6379e9e5e60e64177ac5431c268099ad1dcda5ed814042798a75e3bb4e7d586d3f5262dca46d0dcd38fe26c7b1b059ca0299eaef5ec2051
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bS:sxX7QnxrloE5dpUpeb

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  93f7f9d40d51255da50dd355c4be6c622961412b9ad36ff6039dd7e76b465b6d
- Size
  
  2.6MB
- MD5
  
  2c871e3cfcf9f09145fd7bfcc79fd223
- SHA1
  
  62d7b02b6a07910e5880971594b6b6260ef0417c
- SHA256
  
  93f7f9d40d51255da50dd355c4be6c622961412b9ad36ff6039dd7e76b465b6d
- SHA512
  
  36d1c0d09dcb8032f6379e9e5e60e64177ac5431c268099ad1dcda5ed814042798a75e3bb4e7d586d3f5262dca46d0dcd38fe26c7b1b059ca0299eaef5ec2051
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBlB/bS:sxX7QnxrloE5dpUpeb
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer