General

  • Target

    9314cc8e14abbb1d999dad197928994870796ecb38f9231dbfa520f7e886281c

  • Size

    553KB

  • Sample

    220122-bylhwshcdp

  • MD5

    47241b232e909b7a263d4229cf229b17

  • SHA1

    96e56e95aa15619f513672c669946bb86185b8d6

  • SHA256

    9314cc8e14abbb1d999dad197928994870796ecb38f9231dbfa520f7e886281c

  • SHA512

    65d17e5033051aa215cea99402e9410e40b264b12265e4887121cfc2bcd86376aaf110d99e5e89367c07df0d76c39301ab8ad8e5e47978120bc3e3188e9f7fe1

Malware Config

Targets

    • Target

      9314cc8e14abbb1d999dad197928994870796ecb38f9231dbfa520f7e886281c

    • Size

      553KB

    • MD5

      47241b232e909b7a263d4229cf229b17

    • SHA1

      96e56e95aa15619f513672c669946bb86185b8d6

    • SHA256

      9314cc8e14abbb1d999dad197928994870796ecb38f9231dbfa520f7e886281c

    • SHA512

      65d17e5033051aa215cea99402e9410e40b264b12265e4887121cfc2bcd86376aaf110d99e5e89367c07df0d76c39301ab8ad8e5e47978120bc3e3188e9f7fe1

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks