obj3ctivity | 3af1eea1320c617f8607630704e19422a743eac1b6fb5e941ccb3e88f320610b | Triage

Sharing

General

Target

17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe
Size

895KB
Sample

250115-j7ka7awrfv
MD5

2ae0772ccbb6ba5fdbd9c2e8369d0f02
SHA1

16ecc3070e5a4347d8bee0d5fed8f99c57769efc
SHA256

3af1eea1320c617f8607630704e19422a743eac1b6fb5e941ccb3e88f320610b
SHA512

ff12e0c7dbbc25ccfbbd3a4f2d0665d2ed826b0ac8695307c523f9e748b29031dafa38c1fae64b3f847b81c27a40a5ab94d7c663cc741d9047094b8ea02c95c6
SSDEEP

24576:2Bf3DbcnrLRjnFVBSU8IjCBuYouaWiKe6MC8EimkXctAzBktNVwqk8zGZsHgPuPK:PfhXG

Score

10^/10

obj3ctivity collection discovery persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe
- Size
  
  895KB
- MD5
  
  2ae0772ccbb6ba5fdbd9c2e8369d0f02
- SHA1
  
  16ecc3070e5a4347d8bee0d5fed8f99c57769efc
- SHA256
  
  3af1eea1320c617f8607630704e19422a743eac1b6fb5e941ccb3e88f320610b
- SHA512
  
  ff12e0c7dbbc25ccfbbd3a4f2d0665d2ed826b0ac8695307c523f9e748b29031dafa38c1fae64b3f847b81c27a40a5ab94d7c663cc741d9047094b8ea02c95c6
- SSDEEP
  
  24576:2Bf3DbcnrLRjnFVBSU8IjCBuYouaWiKe6MC8EimkXctAzBktNVwqk8zGZsHgPuPK:PfhXG
Score

10^/10

obj3ctivity collection discovery persistence privilege_escalation spyware stealer
- Detects Obj3ctivity Stage1
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer
- Obj3ctivity family
  obj3ctivity
- Obj3ctivity, PXRECVOWEIWOEI
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer obj3ctivity
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealerobj3ctivity

behavioral1

obj3ctivitycollectiondiscoverypersistenceprivilege_escalationspywarestealer

behavioral2

obj3ctivitycollectiondiscoverypersistenceprivilege_escalationspywarestealer