General

  • Target

    SecuriteInfo.com.Trojan.PWS.Siggen2.59718.4609.2369

  • Size

    81KB

  • Sample

    201116-hh1gge8edn

  • MD5

    42e13e9fb45e01c567b6d3c34caab781

  • SHA1

    97b2eaec93100f16d1878e6903896eb00f626925

  • SHA256

    cca3df47e9579ccc7c35bee02c9ab2c1b55643e50e57528abf840229b5d082a8

  • SHA512

    7d98335fc2c6f08deca2ed814c702c45a20cbf197d93d7a6a1b2d4223aadbf10483c456a8b326d0d4debf63cb3c499af745203c92ac19b21807b0b2b7693391a

Score
8/10

Malware Config

Targets

    • Target

      SecuriteInfo.com.Trojan.PWS.Siggen2.59718.4609.2369

    • Size

      81KB

    • MD5

      42e13e9fb45e01c567b6d3c34caab781

    • SHA1

      97b2eaec93100f16d1878e6903896eb00f626925

    • SHA256

      cca3df47e9579ccc7c35bee02c9ab2c1b55643e50e57528abf840229b5d082a8

    • SHA512

      7d98335fc2c6f08deca2ed814c702c45a20cbf197d93d7a6a1b2d4223aadbf10483c456a8b326d0d4debf63cb3c499af745203c92ac19b21807b0b2b7693391a

    Score
    8/10
    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

Collection

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Tasks