General

  • Target

    PRODUCT LIST FOR MID JULY PURCHASE - 20200708.exe

  • Size

    724KB

  • Sample

    200709-sv38v8kzan

  • MD5

    aa488760f74cdffa5065895a9d4e16c9

  • SHA1

    1b418d57105690110b99ee6a52debef159512713

  • SHA256

    51e016d7614461f51389151f4dce30de7db0945f781b4d7d6ec6ab1ef97935fa

  • SHA512

    46975ca30c0035d58c3c7c15812a7d4cfaa192f2585fa8bb6995665d137a398a7997ceed51e4eb7b0961cdf41442b77d9ef33a3f88b2e0df99588466b009c51b

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    samiprinting.com
  • Port:
    25
  • Username:
    [email protected]
  • Password:
    7194066@Rahat

Targets

    • Target

      PRODUCT LIST FOR MID JULY PURCHASE - 20200708.exe

    • Size

      724KB

    • MD5

      aa488760f74cdffa5065895a9d4e16c9

    • SHA1

      1b418d57105690110b99ee6a52debef159512713

    • SHA256

      51e016d7614461f51389151f4dce30de7db0945f781b4d7d6ec6ab1ef97935fa

    • SHA512

      46975ca30c0035d58c3c7c15812a7d4cfaa192f2585fa8bb6995665d137a398a7997ceed51e4eb7b0961cdf41442b77d9ef33a3f88b2e0df99588466b009c51b

    Score
    10/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks