General
-
Target
OZD Payment Information TT784677U.rar
-
Size
362KB
-
Sample
210227-ykrw6w4166
-
MD5
5acf0076a3d4149de7d704ec8cabc0fa
-
SHA1
d7ac748b97fee51a084c3b83ec1908f377b98183
-
SHA256
d0602b164387e99fb78ae30de05070356e7d1165a3d8c67f708c7d4f2e78c2b6
-
SHA512
0e314412c4becbde70ed5f36f0628a972b6da850e31c525397a3889808ce16501b45a354f27ef16559f202011492874c911993b5959da106aef068d33414cfbe
Static task
static1
Behavioral task
behavioral1
Sample
OZD Payment Information TT784677U.scr
Resource
win7v20201028
Malware Config
Targets
-
-
Target
OZD Payment Information TT784677U.scr
-
Size
1.1MB
-
MD5
05e699f1763f039ca9f696ef520c3b1e
-
SHA1
e9dbd4a76a1ede5f201a849f9ba4d5cd1b35d796
-
SHA256
ae8189a4bb0e5d94c656e530686caed2b724cfe2def4febecca71288280fd275
-
SHA512
7d98738252993857f76267e45115bcf7cd3d9db7460ab47eef041437f936408998d0a3029f572884706cce2e70db0dda223a4db7079a0d423cd82e7eb12c94c8
-
BitRAT Payload
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-