General
- Target b8223eef9170e19727391ffec8b7dec3.exe
- Size 2.6MB
- Sample201216-t4yj4tbp46
- SHA256 586db73f0c9c8a852533d500b667211da84f2621c79c2cf19f471655db0cd64f
- MD5 b8223eef9170e19727391ffec8b7dec3
- SHA1 38b3b8eeb200a95f36927e8a756320df0201658b
- SHA512 b211cb8b717414c7e40cdaf155ad52481f384106bbcfef9d8b7a733c378d3eef381ed8ca8512619a4ef1fd5cef42409ddf2208c1d0c94dc33d4bf3537fadf96d
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
b8223eef9170e19727391ffec8b7dec3.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b8223eef9170e19727391ffec8b7dec3.exe
Resource
win10v20201028
0 signatures
0 seconds
Malware Config
Targets
-
- Target b8223eef9170e19727391ffec8b7dec3.exe
- Size 2.6MB
- SHA256 586db73f0c9c8a852533d500b667211da84f2621c79c2cf19f471655db0cd64f
- MD5 b8223eef9170e19727391ffec8b7dec3
- SHA1 38b3b8eeb200a95f36927e8a756320df0201658b
- SHA512 b211cb8b717414c7e40cdaf155ad52481f384106bbcfef9d8b7a733c378d3eef381ed8ca8512619a4ef1fd5cef42409ddf2208c1d0c94dc33d4bf3537fadf96d
- MD5 SHA1 SHA512
Score10/10-
Modifies WinLogon for persistence
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext