General

  • Target
    ED330FF9FFEB5C0935FDDD855FB4CBC0.exe
  • Size 496KB
  • Sample210724-g8sawbl3de
  • SHA256 2eee0fe004e7d90317053ea8f10fddcc0dc4c7ab9e17ab50b96a6ea167eb855e
  • MD5 SHA1 SHA512

Malware Config

Targets

    • Target
      ED330FF9FFEB5C0935FDDD855FB4CBC0.exe
    • Size 496KB
    • SHA256 2eee0fe004e7d90317053ea8f10fddcc0dc4c7ab9e17ab50b96a6ea167eb855e
    • MD5 SHA1 SHA512
    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks