General
-
Target
Payment Slip.exe
-
Size
278KB
-
Sample
200728-fwjvj9vl9a
-
MD5
e2ac3d9facc2259a85c66087ff0b6a85
-
SHA1
b592f4eea4d6632f6f543c75d71c4749e8aa8b69
-
SHA256
370f3e9f42d074cd9575a0fa8df285e970dda741ae4200b54fb53f0a3145369e
-
SHA512
226bf723fc4094cf2ac6ca74ff9fdefc0daebe90de2d905b0b9c7acae8c9d3e3956c17f1df80d736bb2bae094d075d307c05534485eae6c51575b2939261ae4c
Static task
static1
Behavioral task
behavioral1
Sample
Payment Slip.exe
Resource
win7
Behavioral task
behavioral2
Sample
Payment Slip.exe
Resource
win10v200722
Malware Config
Targets
-
-
Target
Payment Slip.exe
-
Size
278KB
-
MD5
e2ac3d9facc2259a85c66087ff0b6a85
-
SHA1
b592f4eea4d6632f6f543c75d71c4749e8aa8b69
-
SHA256
370f3e9f42d074cd9575a0fa8df285e970dda741ae4200b54fb53f0a3145369e
-
SHA512
226bf723fc4094cf2ac6ca74ff9fdefc0daebe90de2d905b0b9c7acae8c9d3e3956c17f1df80d736bb2bae094d075d307c05534485eae6c51575b2939261ae4c
Score8/10-
Adds policy Run key to start application
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-