64dbef2a82943ec8cf9ad97177cafe53808586e7a3b39984a1bfd9f5c9b76ea5 | Triage

Resubmissions

23/10/2024, 16:32

241023-t17s1szejg 7

10/10/2024, 17:44

241010-wbglmstdnr 10

Sharing

General

Target

DoomRatBuilder.exe
Size

13.1MB
Sample

241023-t17s1szejg
MD5

5a25fdddbf9c2a2108d6c70478da999f
SHA1

d9c9aad0605a76a443ec1e13fcfdbf2f67e667a4
SHA256

64dbef2a82943ec8cf9ad97177cafe53808586e7a3b39984a1bfd9f5c9b76ea5
SHA512

47a8b80758dcec95671dfd72e41fccb78f9ed04f17f7c7a5089d3237f7094d5029bc10b853da97d6c2e8b5de8bcba09618821e2a4d5d2ae15b6b8e9e6eebe191
SSDEEP

393216:7GV21SQhZ2YsHFUK2Jn1+TtIiFQS2NXNsIX3WabTToj:OFQZ2YwUlJn1QtIm28Inpzo

Score

7^/10

discovery pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  DoomRatBuilder.exe
- Size
  
  13.1MB
- MD5
  
  5a25fdddbf9c2a2108d6c70478da999f
- SHA1
  
  d9c9aad0605a76a443ec1e13fcfdbf2f67e667a4
- SHA256
  
  64dbef2a82943ec8cf9ad97177cafe53808586e7a3b39984a1bfd9f5c9b76ea5
- SHA512
  
  47a8b80758dcec95671dfd72e41fccb78f9ed04f17f7c7a5089d3237f7094d5029bc10b853da97d6c2e8b5de8bcba09618821e2a4d5d2ae15b6b8e9e6eebe191
- SSDEEP
  
  393216:7GV21SQhZ2YsHFUK2Jn1+TtIiFQS2NXNsIX3WabTToj:OFQZ2YwUlJn1QtIm28Inpzo
Score

7^/10

discovery spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryspywarestealer