General
- Target tracker.doc
- Size 211KB
- Sample200709-2mcg5ntyzs
- SHA256 be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662
- MD5 9c78815dce144b8ee97f952d3e8c106b
- SHA1 2c4b4d224c4577a5c513baaa9318b5b2d962b483
- SHA512 740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565
- MD5 SHA1 SHA512
Score
8/10
Static task
static1
Behavioral task
behavioral1
Sample
tracker.doc
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tracker.doc
Resource
win10v200430
0 signatures
0 seconds
Malware Config
Targets
-
- Target tracker.doc
- Size 211KB
- SHA256 be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662
- MD5 9c78815dce144b8ee97f952d3e8c106b
- SHA1 2c4b4d224c4577a5c513baaa9318b5b2d962b483
- SHA512 740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565
- MD5 SHA1 SHA512
Score8/10-
Blacklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Suspicious use of SetThreadContext