Overview

overview

8

Static

static

5

50e61dc762...79.exe

windows10-2004-x64

8

50e61dc762...79.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    50e61dc7624cdd79f3d44eaf7fa2f7b8ac71348f0e3982b964e4251d94fb4c79.zip
  • Size 2.0MB
  • Sample260809-sxxyzabb24
  • SHA256 92aaf5ac31b25b7dbd090ad599fbc4ce9886b26f22fbfed2a91ac11a16939022
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistencespywarestealer

Malware Config

Targets

    • Target
      50e61dc7624cdd79f3d44eaf7fa2f7b8ac71348f0e3982b964e4251d94fb4c79
    • Size 3.6MB
    • SHA256 50e61dc7624cdd79f3d44eaf7fa2f7b8ac71348f0e3982b964e4251d94fb4c79
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecutionpersistencespywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Detect suspicious telegram bot

      Detect suspicious telegram bot.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks