General
-
Target
01_extracted.exe
-
Size
1.1MB
-
Sample
200717-fytl1l14te
-
MD5
bea9ed2395cb83c1680ee33fd231fef9
-
SHA1
2620700b8c76d4236321f2a15b6392184df943e5
-
SHA256
680e65e6219bd366e58a94117c26b39487a3bb274d1fa15537cdc9efc1e655ba
-
SHA512
d0275ef36e13674de2505ef5997c594405f59a6327a2cfbd22cd5e185da673fd98c6ee2e4f7566083aeb7b86b955b24d6288b3d27b455d8c876155d788a6e177
Static task
static1
Behavioral task
behavioral1
Sample
01_extracted.exe
Resource
win7
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.com - Port:
587 - Username:
[email protected] - Password:
payments00
Targets
-
-
Target
01_extracted.exe
-
Size
1.1MB
-
MD5
bea9ed2395cb83c1680ee33fd231fef9
-
SHA1
2620700b8c76d4236321f2a15b6392184df943e5
-
SHA256
680e65e6219bd366e58a94117c26b39487a3bb274d1fa15537cdc9efc1e655ba
-
SHA512
d0275ef36e13674de2505ef5997c594405f59a6327a2cfbd22cd5e185da673fd98c6ee2e4f7566083aeb7b86b955b24d6288b3d27b455d8c876155d788a6e177
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-