General
-
Target
Purchase Order 24432 .xlsx
-
Size
14KB
-
Sample
200709-bpdtktld8n
-
MD5
d31859fb69340e3d8aee9d8bc98dfed5
-
SHA1
6b31e11e8c43a222bd07cd79273d9013b2137001
-
SHA256
59f1f955f073e2a326d914a15fff168d9c304795270b26bdfb5e1d68d1f96742
-
SHA512
94ac7f4d94f7c78d1e4a3a16f90d251bd7a815949039294b340375b0da5d2515444dc97e2319dbe6849267ee77f73470ff960db599ad6dae67c80e8e84052f00
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 24432 .xlsx
Resource
win7v200430
Behavioral task
behavioral2
Sample
Purchase Order 24432 .xlsx
Resource
win10
Malware Config
Targets
-
-
Target
Purchase Order 24432 .xlsx
-
Size
14KB
-
MD5
d31859fb69340e3d8aee9d8bc98dfed5
-
SHA1
6b31e11e8c43a222bd07cd79273d9013b2137001
-
SHA256
59f1f955f073e2a326d914a15fff168d9c304795270b26bdfb5e1d68d1f96742
-
SHA512
94ac7f4d94f7c78d1e4a3a16f90d251bd7a815949039294b340375b0da5d2515444dc97e2319dbe6849267ee77f73470ff960db599ad6dae67c80e8e84052f00
Score8/10-
Blacklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Suspicious use of SetThreadContext
-