General

  • Target

    6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5

  • Size

    512KB

  • Sample

    201112-n32j3qz5ce

  • MD5

    240971ad438507330eb673bb3e468aa0

  • SHA1

    4e2b93540067b39ea72251c5cc38b1a27d3d0942

  • SHA256

    6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5

  • SHA512

    2e32880134315a2b7e9137c2e8b9499ecf9cfe4dc13e3711dc9ce57d485ee1768e1c3a964f8e45f8a37d96819c7db9c449b811f19ee13795b298630f617dc04e

Score
7/10

Malware Config

Targets

    • Target

      6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5

    • Size

      512KB

    • MD5

      240971ad438507330eb673bb3e468aa0

    • SHA1

      4e2b93540067b39ea72251c5cc38b1a27d3d0942

    • SHA256

      6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5

    • SHA512

      2e32880134315a2b7e9137c2e8b9499ecf9cfe4dc13e3711dc9ce57d485ee1768e1c3a964f8e45f8a37d96819c7db9c449b811f19ee13795b298630f617dc04e

    Score
    7/10
    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks