General

  • Target

    NEW PO.exe

  • Size

    552KB

  • Sample

    200709-3xy6hgj3bn

  • MD5

    a6da76fa51f029d56650a892efc0f353

  • SHA1

    1e23cde32f44ea7e2eb4a23248a8c7d40b595e2c

  • SHA256

    80f41a09d12356205262bb77b16daeaf2a284a89fd737b042149a4207f16c702

  • SHA512

    a1b4d0ca8066f83453004eac7e73baf94575d4af45f2a00c1fe42bff70a8375105a685efecad2c52604ecf3b5e9300650588fdaf9cb1330e00ba00795b5832b9

Score
7/10

Malware Config

Targets

    • Target

      NEW PO.exe

    • Size

      552KB

    • MD5

      a6da76fa51f029d56650a892efc0f353

    • SHA1

      1e23cde32f44ea7e2eb4a23248a8c7d40b595e2c

    • SHA256

      80f41a09d12356205262bb77b16daeaf2a284a89fd737b042149a4207f16c702

    • SHA512

      a1b4d0ca8066f83453004eac7e73baf94575d4af45f2a00c1fe42bff70a8375105a685efecad2c52604ecf3b5e9300650588fdaf9cb1330e00ba00795b5832b9

    Score
    7/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run entry to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks