General

  • Target

    77f2cba48c800cf3c24b14a60168158a

  • Size

    1.1MB

  • Sample

    210721-q97h64ayd6

  • MD5

    77f2cba48c800cf3c24b14a60168158a

  • SHA1

    00a705f2443da3e5e030e78eea308ef96997f3f5

  • SHA256

    4639173bfdc5b0702df9a307a2de81d7973b0e2196c7ba07f5ff02ec3be3beec

  • SHA512

    2960df19449598ec788cd37bf731110da505b1e3ff0fb7a5a33b0b355df53c3a73f703bff33649d0570c2cd78ea8cac696f2d5491d2957d3666d7893392f8ff2

Malware Config

Targets

    • Target

      77f2cba48c800cf3c24b14a60168158a

    • Size

      1.1MB

    • MD5

      77f2cba48c800cf3c24b14a60168158a

    • SHA1

      00a705f2443da3e5e030e78eea308ef96997f3f5

    • SHA256

      4639173bfdc5b0702df9a307a2de81d7973b0e2196c7ba07f5ff02ec3be3beec

    • SHA512

      2960df19449598ec788cd37bf731110da505b1e3ff0fb7a5a33b0b355df53c3a73f703bff33649d0570c2cd78ea8cac696f2d5491d2957d3666d7893392f8ff2

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks