General
-
Target
SecuriteInfo.com.Heur.19541.4524
-
Size
44KB
-
Sample
201031-k771crrdts
-
MD5
8314722ca0a38f3b9fc1a9dea926e2bf
-
SHA1
d8c9e94a2cdadfb8ffe88fc4d4f5fa05ed5e67f3
-
SHA256
a3593fb7e5fa0edac70c519665db5323e708569055ab5717cc7b4ade40216db1
-
SHA512
3ab756b5fb4e597b778920716e5061c0dcf535c1ee882b0770819bce80acac44842e77f4873af6a521dd4fd19ed099bb988600b641b4b558cdc14f26f2624e77
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.19541.4524.xls
Resource
win10v20201028
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3500_606658365\us_tv_and_film.txt
Extracted
C:\Users\Admin\AppData\Local\Temp\3500_606658365\english_wikipedia.txt
https
http
Targets
-
-
Target
SecuriteInfo.com.Heur.19541.4524
-
Size
44KB
-
MD5
8314722ca0a38f3b9fc1a9dea926e2bf
-
SHA1
d8c9e94a2cdadfb8ffe88fc4d4f5fa05ed5e67f3
-
SHA256
a3593fb7e5fa0edac70c519665db5323e708569055ab5717cc7b4ade40216db1
-
SHA512
3ab756b5fb4e597b778920716e5061c0dcf535c1ee882b0770819bce80acac44842e77f4873af6a521dd4fd19ed099bb988600b641b4b558cdc14f26f2624e77
Score10/10-
Executes dropped EXE
-
Modifies WinLogon to allow AutoLogon
Enables rebooting of the machine without requiring login credentials.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
JavaScript code in executable
-