General
- Target Christmas Shipment 102120208586_PDF.exe
- Size 349KB
- Sample201022-cxcnhy84b2
- SHA256 3dd49a4c4138beb588bd295bdf95af66f5d4779cb1d70731a3702dd08c794d66
Score
10/10
Malware Config
Targets
-
- Target Christmas Shipment 102120208586_PDF.exe
- Size 349KB
- SHA256 3dd49a4c4138beb588bd295bdf95af66f5d4779cb1d70731a3702dd08c794d66
Score10/10-
HiveRAT
HiveRAT is an improved version of FirebirdRAT with various capabilities.
-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
HiveRAT Payload
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext