General
-
Target
PO#87324.scr
-
Size
689KB
-
Sample
200708-5azvlpnww2
-
MD5
561b9a164ba940c40fafca1388cfba6e
-
SHA1
de5c90e013c3ec5d65154ce7a06ea5bc81ff6dda
-
SHA256
9daff52b5fd16bd2ff808e6b4ba02d6b46e00d27520ffaabdf42e20d1378a15c
-
SHA512
e6a1ae9ac2d736a9f02a70dd2035f2bddd46737678ca769743f4450d67c4ff7ceeffac9f43e8b6fe16c0b0eeeb31b4b45eb7db1d4513dd85ae440294d4a10b9b
Static task
static1
Behavioral task
behavioral1
Sample
PO#87324.scr
Resource
win7
Behavioral task
behavioral2
Sample
PO#87324.scr
Resource
win10v200430
Malware Config
Targets
-
-
Target
PO#87324.scr
-
Size
689KB
-
MD5
561b9a164ba940c40fafca1388cfba6e
-
SHA1
de5c90e013c3ec5d65154ce7a06ea5bc81ff6dda
-
SHA256
9daff52b5fd16bd2ff808e6b4ba02d6b46e00d27520ffaabdf42e20d1378a15c
-
SHA512
e6a1ae9ac2d736a9f02a70dd2035f2bddd46737678ca769743f4450d67c4ff7ceeffac9f43e8b6fe16c0b0eeeb31b4b45eb7db1d4513dd85ae440294d4a10b9b
Score8/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Suspicious use of SetThreadContext
-