2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893 | Triage

Sharing

General

Target

2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893
Size

141KB
Sample

250125-c9p6wstjbq
MD5

2fb51c7043d4c1f4e4017f14c03f2066
SHA1

a72c0944dfa7549a08c0a49679b79b9bf29c7715
SHA256

2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893
SHA512

4b2a1715db7cf7eca7def242ea857741b8c58d753314f3dc2b35fce0ef97b6e18d3243b824016344f6ca7d65a28248cd5f9c093c8191b04ebb08d4df6dcc145c
SSDEEP

3072:JA/aY46tGNFC0VF+sRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:SR46tGfC0jJYHKreQ32hlBG

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893
- Size
  
  141KB
- MD5
  
  2fb51c7043d4c1f4e4017f14c03f2066
- SHA1
  
  a72c0944dfa7549a08c0a49679b79b9bf29c7715
- SHA256
  
  2d81e87085b99ddaccc7d58179426c9cf39d02d572dcc481be227c27bf288893
- SHA512
  
  4b2a1715db7cf7eca7def242ea857741b8c58d753314f3dc2b35fce0ef97b6e18d3243b824016344f6ca7d65a28248cd5f9c093c8191b04ebb08d4df6dcc145c
- SSDEEP
  
  3072:JA/aY46tGNFC0VF+sRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:SR46tGfC0jJYHKreQ32hlBG
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer