phy__1__31629__2649094674__1605642612.exe

General
Target

phy__1__31629__2649094674__1605642612.exe

Size

796KB

Sample

201119-dj429zp4f2

Score
7 /10
MD5

6bcfa9f7cff3724c68ab9d9a5a7cfa61

SHA1

56b9891386dd507afc6fa109feee6eb783abecb9

SHA256

664ed6ed7e3992bdf022771e85f3ccf0930649b105cfe38c6fd1adad75f3b479

SHA512

94eaf0cbd7eea9a6d412eb4ce6d88e83fcb33c50cf545d7a8aa281aca7ed074f34a91c8cdb03429ca11da6cf85bdd974f64f5cbc17246cc8c52e115f0960a776

Malware Config
Targets
Target

phy__1__31629__2649094674__1605642612.exe

MD5

6bcfa9f7cff3724c68ab9d9a5a7cfa61

Filesize

796KB

Score
7 /10
SHA1

56b9891386dd507afc6fa109feee6eb783abecb9

SHA256

664ed6ed7e3992bdf022771e85f3ccf0930649b105cfe38c6fd1adad75f3b479

SHA512

94eaf0cbd7eea9a6d412eb4ce6d88e83fcb33c50cf545d7a8aa281aca7ed074f34a91c8cdb03429ca11da6cf85bdd974f64f5cbc17246cc8c52e115f0960a776

Tags

Signatures

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks

                    static1

                    behavioral1

                    7/10

                    behavioral2

                    7/10