2ff4d396642fe645f20092ed01bd952a13de311a85635f535a7ae1fd21fa5e8e | Triage

Sharing

General

Target

2ff4d396642fe645f20092ed01bd952a13de311a85635f535a7ae1fd21fa5e8eN.exe
Size

2.6MB
Sample

241120-fvecma1fjd
MD5

8a2de1a619b66fb9813a0e8f2a310a60
SHA1

5822dfc297539ff9f2f6ed305167296cac803000
SHA256

2ff4d396642fe645f20092ed01bd952a13de311a85635f535a7ae1fd21fa5e8e
SHA512

52964fc7ff81c1fa2b3143b9effb09e62c66b36265ecbdd5a71643c1882164859549341bfcf88e91d0713d656a38e668908ae6437675e3290355fd33b08e0f68
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSq:sxX7QnxrloE5dpUpJbV

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2ff4d396642fe645f20092ed01bd952a13de311a85635f535a7ae1fd21fa5e8eN.exe
- Size
  
  2.6MB
- MD5
  
  8a2de1a619b66fb9813a0e8f2a310a60
- SHA1
  
  5822dfc297539ff9f2f6ed305167296cac803000
- SHA256
  
  2ff4d396642fe645f20092ed01bd952a13de311a85635f535a7ae1fd21fa5e8e
- SHA512
  
  52964fc7ff81c1fa2b3143b9effb09e62c66b36265ecbdd5a71643c1882164859549341bfcf88e91d0713d656a38e668908ae6437675e3290355fd33b08e0f68
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBmB/bSq:sxX7QnxrloE5dpUpJbV
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer