General
-
Target
211dd0de-d590-4b9e-83ef-b0583824ba1e.zip
-
Size
3.6MB
-
Sample
210715-shfbrgwzkx
-
MD5
8688ddfe5c046e57bf570a4a0196a8f4
-
SHA1
98f803b960a40da3df281ceee1951cfb7aeeb2fd
-
SHA256
5cbc5083d0c8ab91c9d538a2e5a8e51fdbafe0caa37173a0176413d4cbba064e
-
SHA512
c20e6b8c7d78347f4c1d7cdf386102ae520e8706da33189c286726a89d0f37f1efd81eff257d73381dc9b7756644b1e8d785a59cb1cf5dca26326a138110f06d
Malware Config
Targets
-
-
Target
Users/Administrator/AppData/Local/Google/Chrome/User Data/Default/Cache/f_0000c5
-
Size
3.6MB
-
MD5
aa48774579e4468e629e344cbb4a5a12
-
SHA1
9397efdbc42d509f5f4c51903f125530b81f5fc6
-
SHA256
033d58611b17fe96939b2092f1d486341206d547545d4bc0bf12c2097436ccdd
-
SHA512
ba52d727efee5b3da0fc221fca92cda92790e013f222d4a32edc98cb4ddd508822966bde9a65f10834105c29cfcd94363ccb48e840c8c8b7db99678ac1186c92
Score10/10-
Registers COM server for autorun
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Sets service image path in registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-