General
-
Target
Invoice AWB00015564.exe
-
Size
743KB
-
Sample
201027-6lnx5xwh26
-
MD5
9ab53021910d341db01247be219738dd
-
SHA1
45c9b363f480a24db575a0b8656efa929b905cd4
-
SHA256
9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377
-
SHA512
30a11381d4d87f1e15ebf5c0feb0a830b3ec0de9f4f85d31aacf42e0777a1fa0306f7cae093d17bbefb4bd984e409fae019ec6eed737556bc1336e34953e0e1e
Static task
static1
Behavioral task
behavioral1
Sample
Invoice AWB00015564.exe
Resource
win7
Malware Config
Targets
-
-
Target
Invoice AWB00015564.exe
-
Size
743KB
-
MD5
9ab53021910d341db01247be219738dd
-
SHA1
45c9b363f480a24db575a0b8656efa929b905cd4
-
SHA256
9d0a5b6d215e8b25ebd13b8a3833040284d73a13381ed263ed313fffe3ab4377
-
SHA512
30a11381d4d87f1e15ebf5c0feb0a830b3ec0de9f4f85d31aacf42e0777a1fa0306f7cae093d17bbefb4bd984e409fae019ec6eed737556bc1336e34953e0e1e
-
Deletes itself
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-