38880a64e1b58849988b3b27fee878a259997800b69d20b759e8eec9fff7ee93 | Triage

Sharing

General

Target

38880a64e1b58849988b3b27fee878a259997800b69d20b759e8eec9fff7ee93.exe
Size

3.2MB
Sample

241120-cvyvgstjhn
MD5

26d35b9a18e3a46998e470e36bdb81ce
SHA1

33144304532a6fe70057161dd63a69ff5a51b1e0
SHA256

38880a64e1b58849988b3b27fee878a259997800b69d20b759e8eec9fff7ee93
SHA512

37a4938b766bd1dfc3391d28c519aac1fc5f2cf4d996645833cd6b8115cb76500e6f445b0531261ad8a7bed1db027bee9852b8d04e4f41600be9ac5efdbbecd0
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8b6LNXJqI20t+:sxX7QnxrloE5dpUpdbVz8eLFczz

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  38880a64e1b58849988b3b27fee878a259997800b69d20b759e8eec9fff7ee93.exe
- Size
  
  3.2MB
- MD5
  
  26d35b9a18e3a46998e470e36bdb81ce
- SHA1
  
  33144304532a6fe70057161dd63a69ff5a51b1e0
- SHA256
  
  38880a64e1b58849988b3b27fee878a259997800b69d20b759e8eec9fff7ee93
- SHA512
  
  37a4938b766bd1dfc3391d28c519aac1fc5f2cf4d996645833cd6b8115cb76500e6f445b0531261ad8a7bed1db027bee9852b8d04e4f41600be9ac5efdbbecd0
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBqB/bSqz8b6LNXJqI20t+:sxX7QnxrloE5dpUpdbVz8eLFczz
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer