General

  • Target

    RFQ.exe

  • Size

    1.1MB

  • Sample

    200714-x1hg9qj4cn

  • MD5

    78d8a849b889ce5fb3e132648e314a7f

  • SHA1

    b4e4bfd611d34feaa1e652146316b322b7af819f

  • SHA256

    edb54d25f0d8e82e12e8abef877e53fa13229bd58e2a981b1f6ec640e56a5f00

  • SHA512

    366d3b8b623c3861cc09077d4051b8c81f30c19e19bede5b094c3335c00d7f569e8880d3685428cd819247d817f799c68cab6e68b13a9421b3106fe21042660d

Score
7/10

Malware Config

Targets

    • Target

      RFQ.exe

    • Size

      1.1MB

    • MD5

      78d8a849b889ce5fb3e132648e314a7f

    • SHA1

      b4e4bfd611d34feaa1e652146316b322b7af819f

    • SHA256

      edb54d25f0d8e82e12e8abef877e53fa13229bd58e2a981b1f6ec640e56a5f00

    • SHA512

      366d3b8b623c3861cc09077d4051b8c81f30c19e19bede5b094c3335c00d7f569e8880d3685428cd819247d817f799c68cab6e68b13a9421b3106fe21042660d

    Score
    7/10
    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks