General

  • Target

    PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

  • Size

    734KB

  • Sample

    200707-7zffaybde2

  • MD5

    959e9da7ae625d201502726f42287a6a

  • SHA1

    d4c6f0d7b6a32966e183ee6cab7a8b92e7e443dd

  • SHA256

    3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8

  • SHA512

    76bc600029c412b55dbfb2de01e1972927c826f460916b410a4e99ae3713acc02c1dd801a1ae2d35a8548b09c951388a6758fc42790dde43ea4cd79f4b7c4ebc

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    samiprinting.com
  • Port:
    25
  • Username:
    [email protected]
  • Password:
    7194066@Rahat

Targets

    • Target

      PURCHASE SPECIFICATIONS FOR PROPOSE ORDER.exe

    • Size

      734KB

    • MD5

      959e9da7ae625d201502726f42287a6a

    • SHA1

      d4c6f0d7b6a32966e183ee6cab7a8b92e7e443dd

    • SHA256

      3b0f4ded1d22a750821ae19238a6797a7bacb7b0c60ee2f564d46ad4861ceee8

    • SHA512

      76bc600029c412b55dbfb2de01e1972927c826f460916b410a4e99ae3713acc02c1dd801a1ae2d35a8548b09c951388a6758fc42790dde43ea4cd79f4b7c4ebc

    Score
    10/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks