Booking Confirmation 110420203251 - copy - PDF.exe

General
Target

Booking Confirmation 110420203251 - copy - PDF.exe

Size

344KB

Sample

201105-8lhrre6d56

Score
10 /10
MD5

f4f48519f108900933d0dd0e8aa1f40f

SHA1

5a48020b486ab74eea85cf88d647dc2ba0994ace

SHA256

f6d2fe1a8ba40429708ec5c70159fcff0e9741ea260ea93e3665d6ea752f96d3

SHA512

d02dc186871c344bddac7ae1a5c1e9c72014e106dfdbe1c565bf7a56ae052b10f7abb69f34010f5315752766bc40a86d1f9e20da2c8c70f7c0aef053ab3248a1

Malware Config
Targets
Target

Booking Confirmation 110420203251 - copy - PDF.exe

MD5

f4f48519f108900933d0dd0e8aa1f40f

Filesize

344KB

Score
10 /10
SHA1

5a48020b486ab74eea85cf88d647dc2ba0994ace

SHA256

f6d2fe1a8ba40429708ec5c70159fcff0e9741ea260ea93e3665d6ea752f96d3

SHA512

d02dc186871c344bddac7ae1a5c1e9c72014e106dfdbe1c565bf7a56ae052b10f7abb69f34010f5315752766bc40a86d1f9e20da2c8c70f7c0aef053ab3248a1

Tags

Signatures

  • HiveRAT

    Description

    HiveRAT is an improved version of FirebirdRAT with various capabilities.

    Tags

  • Beds Protector Packer

    Description

    Detects Beds Protector packer used to load .NET malware.

  • HiveRAT Payload

  • Drops startup file

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral1

                      10/10

                      behavioral2

                      10/10