cb5f3040eb80e8f0a2a546efe839af7f342e0ec3e2325f424a89cc9e0792965a | Triage

Sharing

General

Target

Free_Woofer_EAC_Murda.exe
Size

23KB
Sample

250401-s8qzsstpv2
MD5

132b2818f0ac641643299cace90deea6
SHA1

3fd71f59522ea07f6f4c395a6c66efb1cd37d03a
SHA256

cb5f3040eb80e8f0a2a546efe839af7f342e0ec3e2325f424a89cc9e0792965a
SHA512

da35ce0ea328c03d8e17316da4433d29e0cedcf8ac43acd06d9a65dd7d20dbae391a15608145f6f3a8492d980cea3b90745b0648527730eddf752d1ae2db4a7d
SSDEEP

384:6s3Velp5c0XezK/p00VTbw49Ixpl7DWhXInFZqtFiqxM1L3VJ:Re3DsNabwvvWhC1L3VJ

Score

9^/10

defense_evasion persistence privilege_escalation ransomware spyware stealer

Malware Config

Targets

- Target
  
  Free_Woofer_EAC_Murda.exe
- Size
  
  23KB
- MD5
  
  132b2818f0ac641643299cace90deea6
- SHA1
  
  3fd71f59522ea07f6f4c395a6c66efb1cd37d03a
- SHA256
  
  cb5f3040eb80e8f0a2a546efe839af7f342e0ec3e2325f424a89cc9e0792965a
- SHA512
  
  da35ce0ea328c03d8e17316da4433d29e0cedcf8ac43acd06d9a65dd7d20dbae391a15608145f6f3a8492d980cea3b90745b0648527730eddf752d1ae2db4a7d
- SSDEEP
  
  384:6s3Velp5c0XezK/p00VTbw49Ixpl7DWhXInFZqtFiqxM1L3VJ:Re3DsNabwvvWhC1L3VJ
Score

9^/10

defense_evasion persistence privilege_escalation ransomware spyware stealer
- Clears Windows event logs
  defense_evasion ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Indicator Removal

Clear Windows Event Logs

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionpersistenceprivilege_escalationransomwarespywarestealer