3ab3c26cb500e2288c16e23af3ea4f5e4d2bc6242889691e9cc7ad07a4ee9af4 | Triage

Sharing

General

Target

3ab3c26cb500e2288c16e23af3ea4f5e4d2bc6242889691e9cc7ad07a4ee9af4N.exe
Size

2.6MB
Sample

250120-kxdlbs1rbp
MD5

7f43e702314cf44035235486e870f2c0
SHA1

11d17ff50bccbcda964d01d2439bd3012256f7a0
SHA256

3ab3c26cb500e2288c16e23af3ea4f5e4d2bc6242889691e9cc7ad07a4ee9af4
SHA512

19ab02b8003b9fc4f8009e5aa974da8f643f9bdde5bdae40540f6b283365a8a3a20822cd1cb82e5199ae8a1e1b74384856c180265a09b5c81a0cc38d17b9c5e0
SSDEEP

49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSq:sxX7QnxrloE5dpUpQbV

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  3ab3c26cb500e2288c16e23af3ea4f5e4d2bc6242889691e9cc7ad07a4ee9af4N.exe
- Size
  
  2.6MB
- MD5
  
  7f43e702314cf44035235486e870f2c0
- SHA1
  
  11d17ff50bccbcda964d01d2439bd3012256f7a0
- SHA256
  
  3ab3c26cb500e2288c16e23af3ea4f5e4d2bc6242889691e9cc7ad07a4ee9af4
- SHA512
  
  19ab02b8003b9fc4f8009e5aa974da8f643f9bdde5bdae40540f6b283365a8a3a20822cd1cb82e5199ae8a1e1b74384856c180265a09b5c81a0cc38d17b9c5e0
- SSDEEP
  
  49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LB3B/bSq:sxX7QnxrloE5dpUpQbV
Score

7^/10

discovery persistence spyware stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer