91f4fdc2687907e6f6ff98c2302371175ba51abe8776c7f33e61a33e08b097a3 | Triage

Sharing

General

Target

RFQ-Felype Castro from Brazil.exe
Size

505KB
Sample

200710-1jrmz4d1sx
MD5

63aa1a0f5b295d759ec4b2a0823bdb8d
SHA1

f29ead5094b0354aad5e70f52e1a800cc5c8fb31
SHA256

91f4fdc2687907e6f6ff98c2302371175ba51abe8776c7f33e61a33e08b097a3
SHA512

2ea2c570d707f6699a806b4cf8283503192b899d2ef8f065cf532b56b3d3753c3a7c201b00987b94bda68fd2525e8cbfbadf10bf81b72798ad5ae97cb9fc68be

Score

7^/10

evasion persistence spyware trojan

Malware Config

Targets

- Target
  
  RFQ-Felype Castro from Brazil.exe
- Size
  
  505KB
- MD5
  
  63aa1a0f5b295d759ec4b2a0823bdb8d
- SHA1
  
  f29ead5094b0354aad5e70f52e1a800cc5c8fb31
- SHA256
  
  91f4fdc2687907e6f6ff98c2302371175ba51abe8776c7f33e61a33e08b097a3
- SHA512
  
  2ea2c570d707f6699a806b4cf8283503192b899d2ef8f065cf532b56b3d3753c3a7c201b00987b94bda68fd2525e8cbfbadf10bf81b72798ad5ae97cb9fc68be
Score

7^/10

evasion trojan persistence spyware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run entry to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanpersistencespyware

behavioral2