Resubmissions

21-02-2021 18:55

210221-efpz8dh2q2 1

24-11-2020 02:17

201124-114v6258cn 10

24-11-2020 02:05

201124-hcjk9nn5ba 10

General

  • Target

    MX_Series_Installation_Instructions_BCN-P5968-B_(08.13).pdf

  • Size

    210KB

  • Sample

    201124-114v6258cn

  • MD5

    14d0eece7311dfc25f6a47651404a059

  • SHA1

    b902a9ea5fe894f34739e7934f8838cd12e8b39f

  • SHA256

    ad4e8c8612d092d11e80707f562a5ad86ca1ccb049837d2c20cdf696f01cb2a9

  • SHA512

    f8079aca749a399f5029d9685b34899e105c7e90a38f22d40ed5fc170420904abaccd3e91baef086191f51c978e9092b2d2f8516071b32a1acbf8454706a5f05

Malware Config

Targets

    • Target

      MX_Series_Installation_Instructions_BCN-P5968-B_(08.13).pdf

    • Size

      210KB

    • MD5

      14d0eece7311dfc25f6a47651404a059

    • SHA1

      b902a9ea5fe894f34739e7934f8838cd12e8b39f

    • SHA256

      ad4e8c8612d092d11e80707f562a5ad86ca1ccb049837d2c20cdf696f01cb2a9

    • SHA512

      f8079aca749a399f5029d9685b34899e105c7e90a38f22d40ed5fc170420904abaccd3e91baef086191f51c978e9092b2d2f8516071b32a1acbf8454706a5f05

    • Registers COM server for autorun

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks