General

  • Target

    SOA.exe

  • Size

    390KB

  • Sample

    200709-zt19myj9m2

  • MD5

    57fc2930bc260b400169be12fa4307c7

  • SHA1

    fbe7fce8c58cc24cfce70d7a7c69b4955be5e751

  • SHA256

    e35bc80003b03fd590bc5e94f45857e3a5bddb495af688aed92f2ba790a90f48

  • SHA512

    e2e941bfa7a88a0d655e48b656104f581bce3e2bebe8f2feb43551aeb2eed5613bf19d022cd852bdd24cb11a9a936b36e7e47ab254c7519310cd8064a24a291e

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bigboy5570@@@@

Targets

    • Target

      SOA.exe

    • Size

      390KB

    • MD5

      57fc2930bc260b400169be12fa4307c7

    • SHA1

      fbe7fce8c58cc24cfce70d7a7c69b4955be5e751

    • SHA256

      e35bc80003b03fd590bc5e94f45857e3a5bddb495af688aed92f2ba790a90f48

    • SHA512

      e2e941bfa7a88a0d655e48b656104f581bce3e2bebe8f2feb43551aeb2eed5613bf19d022cd852bdd24cb11a9a936b36e7e47ab254c7519310cd8064a24a291e

    Score
    10/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks