36d6b212bce968e1473e156678cbf4f298109c5689d7f20ba29f63a96d8dc9f0 | Triage

Resubmissions

12-12-2024 18:54

241212-xj8krstle1 3

12-12-2024 18:51

241212-xhfhlatkfx 3

12-12-2024 18:38

241212-w96cnasqh1 8

Sharing

General

Target

AccountSpider NFA Tool.exe
Size

3.5MB
Sample

241212-w96cnasqh1
MD5

38b60696da35d7ca38f59e0e8e9fb4ac
SHA1

52ca2a5386a4d021e31ac0fe0fc4aeff42117056
SHA256

36d6b212bce968e1473e156678cbf4f298109c5689d7f20ba29f63a96d8dc9f0
SHA512

62bdc1acf10fd851a8d3e4676760e9897ba0ea84c25a373612e87c15245bd7604bfd6f00f9c05ac027da5d9171cfd35f0f5540ccd83fa3915ab2ef11da3d4b7b
SSDEEP

49152:qddgucgciQLJ/MzV47Zb/9BPABDaccgX8owpoFkqXfd+/9At5Dt48anoL:tulch/eV4d2MgXzwYkqXf0FMG8WoL

Score

8^/10

steam discovery phishing

Malware Config

Targets

- Target
  
  AccountSpider NFA Tool.exe
- Size
  
  3.5MB
- MD5
  
  38b60696da35d7ca38f59e0e8e9fb4ac
- SHA1
  
  52ca2a5386a4d021e31ac0fe0fc4aeff42117056
- SHA256
  
  36d6b212bce968e1473e156678cbf4f298109c5689d7f20ba29f63a96d8dc9f0
- SHA512
  
  62bdc1acf10fd851a8d3e4676760e9897ba0ea84c25a373612e87c15245bd7604bfd6f00f9c05ac027da5d9171cfd35f0f5540ccd83fa3915ab2ef11da3d4b7b
- SSDEEP
  
  49152:qddgucgciQLJ/MzV47Zb/9BPABDaccgX8owpoFkqXfd+/9At5Dt48anoL:tulch/eV4d2MgXzwYkqXf0FMG8WoL
Score

8^/10

steam discovery phishing
- Downloads MZ/PE file
- Legitimate hosting services abused for malware hosting/C2
- Detected potential entity reuse from brand STEAM.
  phishing steam
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

steamdiscoveryphishing

behavioral2