General
- Target hosts.bin
- Size 1.3MB
- Sample201008-3236rtlty2
- SHA256 da045fcbd63520920626c45655b87da65e0e6cdc26f7bc20dfbfb6f667be9dbf
- MD5 24ffe0dcd9078d0e8ad4f35cad159f91
- SHA1 71accca50bfd123e27d2eeea150191b91e6ff96b
- SHA512 dd59745782616f0f28942b80087bdc8031dbef00d1f2a04a6c48e41199229262f8e46fe9723ce3940421514afc942c224380bdb8cec3f0a0d068492b853235b1
- MD5 SHA1 SHA512
Static task
static1
Malware Config
Targets
-
- Target hosts.bin
- Size 1.3MB
- SHA256 da045fcbd63520920626c45655b87da65e0e6cdc26f7bc20dfbfb6f667be9dbf
- MD5 24ffe0dcd9078d0e8ad4f35cad159f91
- SHA1 71accca50bfd123e27d2eeea150191b91e6ff96b
- SHA512 dd59745782616f0f28942b80087bdc8031dbef00d1f2a04a6c48e41199229262f8e46fe9723ce3940421514afc942c224380bdb8cec3f0a0d068492b853235b1
- MD5 SHA1 SHA512
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable
-
Suspicious use of SetThreadContext