General
-
Target
PO Versand.exe
-
Size
573KB
-
Sample
200708-55a14as8j6
-
MD5
f258c2d0ae8cd38df470bc4e30eaafb1
-
SHA1
918070da7a05b9da82e185f0dae4e402d3b80c00
-
SHA256
4c81acbfbba1297e34208f082d48312a3d6742772ed77796801d833b54fd39e9
-
SHA512
fcdb111238ad9620ee884cdc41eaa7db08c74e5b1836659005e06d2d3397dfecb15dfe54eeed43a32e094339b36b3a841368a092718d78054df7fb4dd9b0a320
Static task
static1
Behavioral task
behavioral1
Sample
PO Versand.exe
Resource
win7v200430
Malware Config
Targets
-
-
Target
PO Versand.exe
-
Size
573KB
-
MD5
f258c2d0ae8cd38df470bc4e30eaafb1
-
SHA1
918070da7a05b9da82e185f0dae4e402d3b80c00
-
SHA256
4c81acbfbba1297e34208f082d48312a3d6742772ed77796801d833b54fd39e9
-
SHA512
fcdb111238ad9620ee884cdc41eaa7db08c74e5b1836659005e06d2d3397dfecb15dfe54eeed43a32e094339b36b3a841368a092718d78054df7fb4dd9b0a320
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-