Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe
-
Size
499KB
-
MD5
b6dd099b4c51edae5ea0c867ff2f12a7
-
SHA1
f13800d747ca3d79785f373af3ce098a0298a6d7
-
SHA256
f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a
-
SHA512
5ada31af3f39f37fcd15b1afc3ab9f6e60fc47d56097130ac2c8ea734f1db1ce93d552014abeb71ab0235fa65d9ed7b2d9c5cd0367acf99df6d32f138cb3d8ec
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jre7\lib\management\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Windows Mail\en-US\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\WET.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CST6CDT.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\Readme.README f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.pysa f0939ebfda6b30a330a00c57497038a54da359e316e0d6e6e71871fd50fec16a.sample.exe