482180cc808f066049147214bc6a64e43c8336e1037a5bcaf4680bcece569ac0 | Triage

Sharing

General

Target

2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch
Size

21.5MB
Sample

241115-cfywyawhre
MD5

378c604b0a9cfe2dd772825b919525c1
SHA1

e7ccec97c078a8800194682ce3ed893546f51d37
SHA256

482180cc808f066049147214bc6a64e43c8336e1037a5bcaf4680bcece569ac0
SHA512

25829b523609a57e9856ab92f7a813383bb6acb874113bd3e3c6f8ce9e5c93188dc39a9ff605e7b679c2519f2dc96c786693ab037c637c1bd089096844fcc63a
SSDEEP

393216:y4PybIvnlSarK/0Y40jq3T9lfn32mYM8sIqkcUsMoSIceieYX208gJ:y4M6ljrYjq35Nn3rYspkdsMMceieYX2q

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  
  2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch
- Size
  
  21.5MB
- MD5
  
  378c604b0a9cfe2dd772825b919525c1
- SHA1
  
  e7ccec97c078a8800194682ce3ed893546f51d37
- SHA256
  
  482180cc808f066049147214bc6a64e43c8336e1037a5bcaf4680bcece569ac0
- SHA512
  
  25829b523609a57e9856ab92f7a813383bb6acb874113bd3e3c6f8ce9e5c93188dc39a9ff605e7b679c2519f2dc96c786693ab037c637c1bd089096844fcc63a
- SSDEEP
  
  393216:y4PybIvnlSarK/0Y40jq3T9lfn32mYM8sIqkcUsMoSIceieYX208gJ:y4M6ljrYjq35Nn3rYspkdsMMceieYX2q
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecution