obj3ctivity | a77aafbb23e8e830c27a832b4cfb7c50d4b2a0bd94c466ed35c94e06f26f6c7d | Triage

Sharing

General

Target

1738744083b545f25dec4f43b54c665120158933d79a07108e8e28f4f5d6ab2ec58cdd6385466.dat-decoded.exe
Size

897KB
Sample

250205-kc4a9aznbq
MD5

ad6fe420229c7620517e19e643571c17
SHA1

eed9cb9ce763afcd5d96073a5d7b5748c1c4f28e
SHA256

a77aafbb23e8e830c27a832b4cfb7c50d4b2a0bd94c466ed35c94e06f26f6c7d
SHA512

c21fb37ab458f5560ea1eea02bedcc2a57e8441e6b4ef1b363113eff7e97328930603cf43a205fe45841201f6131f43b8f6ee013b86399ecde22c82a4b22c6a3
SSDEEP

24576:4+0Q+i45RyIz+gDymKYESup7qAPJNEOfK+pW1Q4R3fiRT2DHDO4jU5oa/0u7xsQ7:N

Score

10^/10

obj3ctivity collection discovery persistence privilege_escalation spyware stealer

Malware Config

Targets

- Target
  
  1738744083b545f25dec4f43b54c665120158933d79a07108e8e28f4f5d6ab2ec58cdd6385466.dat-decoded.exe
- Size
  
  897KB
- MD5
  
  ad6fe420229c7620517e19e643571c17
- SHA1
  
  eed9cb9ce763afcd5d96073a5d7b5748c1c4f28e
- SHA256
  
  a77aafbb23e8e830c27a832b4cfb7c50d4b2a0bd94c466ed35c94e06f26f6c7d
- SHA512
  
  c21fb37ab458f5560ea1eea02bedcc2a57e8441e6b4ef1b363113eff7e97328930603cf43a205fe45841201f6131f43b8f6ee013b86399ecde22c82a4b22c6a3
- SSDEEP
  
  24576:4+0Q+i45RyIz+gDymKYESup7qAPJNEOfK+pW1Q4R3fiRT2DHDO4jU5oa/0u7xsQ7:N
Score

10^/10

obj3ctivity collection discovery persistence privilege_escalation spyware stealer
- Detects Obj3ctivity Stage1
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer
- Obj3ctivity family
  obj3ctivity
- Obj3ctivity, PXRECVOWEIWOEI
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer obj3ctivity
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealerobj3ctivity

behavioral1

obj3ctivitycollectiondiscoverypersistenceprivilege_escalationspywarestealer

behavioral2

obj3ctivitycollectiondiscoverypersistenceprivilege_escalationspywarestealer