6afc3509b816e91592d915001ce75dbe55ab5edc270d562e9ac19d477f1b5d90 | Triage

Sharing

General

Target

6afc3509b816e91592d915001ce75dbe55ab5edc270d562e9ac19d477f1b5d90N.exe
Size

2.6MB
Sample

241120-f8gd5ssglq
MD5

b403201123a1a1a5c84207054518c140
SHA1

79ae6b453b1f9e4e14497af839d4576c66160f7b
SHA256

6afc3509b816e91592d915001ce75dbe55ab5edc270d562e9ac19d477f1b5d90
SHA512

ebfc6234eab14a4f90e110d5ccb528c4bcc958f6f73d7f6aeaa1ffe843a4752f3876fb727c93340d404df6e9506057473c6eb5aac7aa1c6b428b4f00b2e73cb3
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS:sxX7QnxrloE5dpUp/b

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  6afc3509b816e91592d915001ce75dbe55ab5edc270d562e9ac19d477f1b5d90N.exe
- Size
  
  2.6MB
- MD5
  
  b403201123a1a1a5c84207054518c140
- SHA1
  
  79ae6b453b1f9e4e14497af839d4576c66160f7b
- SHA256
  
  6afc3509b816e91592d915001ce75dbe55ab5edc270d562e9ac19d477f1b5d90
- SHA512
  
  ebfc6234eab14a4f90e110d5ccb528c4bcc958f6f73d7f6aeaa1ffe843a4752f3876fb727c93340d404df6e9506057473c6eb5aac7aa1c6b428b4f00b2e73cb3
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBoB/bS:sxX7QnxrloE5dpUp/b
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer