Overview

overview

10

Static

static

Curriculo.lnk

windows7_x64

10

Curriculo.lnk

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Curriculo.lnk

  • Size

    1KB

  • Sample

    211116-xzdekacbbr

  • MD5

    58fe09ef368f345697e2815274739431

  • SHA1

    8b16a02c2afb084e89b12e1a224382165a294bc7

  • SHA256

    215404787c1d072eca5cd4423fae4e01d08527657971abf480b753e78ddecbde

  • SHA512

    edfbb3716b1e7e2bbab6415de74f06e0a28c1f68d3d7dfbf7ee154161295c00c8314359168c5f6eb851a93d1e1c1311fb77217bd83f97b224206fd01e048019d

Score
10/10
latam_generic_downloaderbankerloader

Malware Config

Extracted

Family

latam_generic_downloader

C2

http://ec2-52-53-236-128.us-west-1.compute.amazonaws.com/softcom.base

Targets

    • Target

      Curriculo.lnk

    • Size

      1KB

    • MD5

      58fe09ef368f345697e2815274739431

    • SHA1

      8b16a02c2afb084e89b12e1a224382165a294bc7

    • SHA256

      215404787c1d072eca5cd4423fae4e01d08527657971abf480b753e78ddecbde

    • SHA512

      edfbb3716b1e7e2bbab6415de74f06e0a28c1f68d3d7dfbf7ee154161295c00c8314359168c5f6eb851a93d1e1c1311fb77217bd83f97b224206fd01e048019d

    Score
    10/10
    latam_generic_downloaderbankerloader

    • Generic LATAM Downloader

      Generic Latin American MSI downloader used to drop various banking trojans.

      loaderbankerlatam_generic_downloader

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Use of msiexec (install) with remote resource

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks