General
- Target SHIPPING DOCS..exe
- Size 600KB
- Sample200921-esr7prsqba
- SHA256 c822aa53c6e49a7aa3e32869936583cd7308a414974d76b9bdd196908befbc16
- MD5 903d1b3aaf8dfb1d28919df311cd980e
- SHA1 8e73fb005646fff8677a3cead94b833087979ece
- SHA512 1871ff2d8d34cf410bc400732aa896271d1d25dafa0b94a3302da8ce9aeb9c0a167b374c24333639f3833262bcc58ad76c04f66874cc4d37d4890843fb7546c8
- MD5 SHA1 SHA512
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCS..exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SHIPPING DOCS..exe
Resource
win10v200722
0 signatures
0 seconds
Malware Config
Targets
-
- Target SHIPPING DOCS..exe
- Size 600KB
- SHA256 c822aa53c6e49a7aa3e32869936583cd7308a414974d76b9bdd196908befbc16
- MD5 903d1b3aaf8dfb1d28919df311cd980e
- SHA1 8e73fb005646fff8677a3cead94b833087979ece
- SHA512 1871ff2d8d34cf410bc400732aa896271d1d25dafa0b94a3302da8ce9aeb9c0a167b374c24333639f3833262bcc58ad76c04f66874cc4d37d4890843fb7546c8
- MD5 SHA1 SHA512
Score7/10-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext