General
-
Target
tracker.doc
-
Size
211KB
-
Sample
200709-2mcg5ntyzs
-
MD5
9c78815dce144b8ee97f952d3e8c106b
-
SHA1
2c4b4d224c4577a5c513baaa9318b5b2d962b483
-
SHA256
be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662
-
SHA512
740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565
Static task
static1
Behavioral task
behavioral1
Sample
tracker.doc
Resource
win7
Behavioral task
behavioral2
Sample
tracker.doc
Resource
win10v200430
Malware Config
Targets
-
-
Target
tracker.doc
-
Size
211KB
-
MD5
9c78815dce144b8ee97f952d3e8c106b
-
SHA1
2c4b4d224c4577a5c513baaa9318b5b2d962b483
-
SHA256
be90083aacdd2a3bba483b56ae5b3261317add57233873f86f037aeb3428e662
-
SHA512
740f258ff43f821e37dc6ea8fae043d4894cfb5fc6a2c798f89899629a5c61320cc84ba75be0efdb106e3dae181cbecd51522360a8f236ca486da69602ecb565
Score8/10-
Blacklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Suspicious use of SetThreadContext
-