880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a | Triage

Sharing

General

Target

880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a
Size

307KB
Sample

250401-tpsjystr19
MD5

4043f462ac50a772fe95d6daf0dfc1fb
SHA1

22b7ceeb6ece27b4156a29fcc6aeb5daf2262411
SHA256

880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a
SHA512

c7c018343733a7b1df468e7b120d732249246f8895925d379b41ecb681f049c92fb45aaf8f00441b8abcf15c81f93f2b4c1ad4442ff5a17b1d48fb14f912227c
SSDEEP

6144:T46tGdye41jObiZKDAX0jH0o2zq9DmQ3LOotL4gr:T3NbYbiZKm4H8zq9Fjtdr

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a
- Size
  
  307KB
- MD5
  
  4043f462ac50a772fe95d6daf0dfc1fb
- SHA1
  
  22b7ceeb6ece27b4156a29fcc6aeb5daf2262411
- SHA256
  
  880baad4e605ace7146e96217fe4122f82237a9b10685da769a70d3d0bcea75a
- SHA512
  
  c7c018343733a7b1df468e7b120d732249246f8895925d379b41ecb681f049c92fb45aaf8f00441b8abcf15c81f93f2b4c1ad4442ff5a17b1d48fb14f912227c
- SSDEEP
  
  6144:T46tGdye41jObiZKDAX0jH0o2zq9DmQ3LOotL4gr:T3NbYbiZKm4H8zq9Fjtdr
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer