General
- Target Bank-Deposit-Slip.exe
- Size 851KB
- Sample201109-7x3twmay92
- SHA256 17c7aa7df0ffa47ac142bcf82edb465eedabcc7a307e8726eb12c92698302e16
- MD5 7b87763ef937ee2af677b34930a4f47b
- SHA1 eec97aa5600ff2f22d7e5cda9efe8001e1ec1637
- SHA512 6f6bbe48f3166b6efb376250c8f6d7f66f59dacee96155341f21f8c5283e1b3f41aa1b0e180135166b7dc15378aeb51e8dc0d2709285afcb7e907b970d4e5003
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Bank-Deposit-Slip.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.professionals.biz.pk
-
Port
587
-
Username
-
Password
5HP&k4*z8jpf
Targets
-
- Target Bank-Deposit-Slip.exe
- Size 851KB
- SHA256 17c7aa7df0ffa47ac142bcf82edb465eedabcc7a307e8726eb12c92698302e16
- MD5 7b87763ef937ee2af677b34930a4f47b
- SHA1 eec97aa5600ff2f22d7e5cda9efe8001e1ec1637
- SHA512 6f6bbe48f3166b6efb376250c8f6d7f66f59dacee96155341f21f8c5283e1b3f41aa1b0e180135166b7dc15378aeb51e8dc0d2709285afcb7e907b970d4e5003
- MD5 SHA1 SHA512
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext