Overview

overview

10

Static

static

FA.2020.06...CX.exe

windows7_x64

10

FA.2020.06...CX.exe

windows10_x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    FA.2020.06.5597.DOCX.exe
  • Size 383KB
  • Sample200629-e7pvcrjgxn
  • SHA256 f41d910195a48409a0d7047fa3e9d2d62b19361c92f8f2f045d9a4ba7a0e869e
  • MD5 SHA1 SHA512
Score
10/10
persistencespyware

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    2.56.8.145
  • Port

    21
  • Username

    davidre@davidreuben
  • Password

    mypassword

Targets

    • Target
      FA.2020.06.5597.DOCX.exe
    • Size 383KB
    • SHA256 f41d910195a48409a0d7047fa3e9d2d62b19361c92f8f2f045d9a4ba7a0e869e
    • MD5 SHA1 SHA512
    Score
    10/10
    persistencespyware

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks