Overview

overview

10

Static

static

b06ca9689a...96.exe

windows7_x64

10

b06ca9689a...96.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b06ca9689a517fa053a77ebce8fab696.exe

  • Size

    605KB

  • Sample

    220202-k4fz2ahhd8

  • MD5

    b06ca9689a517fa053a77ebce8fab696

  • SHA1

    06691dda8b7f412ba4c31f2f78678acbc8262881

  • SHA256

    2f848ea94d4a48694c68e472882222c054d12797c0f7eabd7ebdb9daebd27ece

  • SHA512

    9af05fe8d4b2ecb0abcc3283af18950912cc0888bc1a98b3f9164cd839c41ddf6a2dea2c62dfcaaf8b53dac0eb8255ef6527e3f81f6908677d1ed5bce557e917

Score
10/10
spywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    10203040eam.

Targets

    • Target

      b06ca9689a517fa053a77ebce8fab696.exe

    • Size

      605KB

    • MD5

      b06ca9689a517fa053a77ebce8fab696

    • SHA1

      06691dda8b7f412ba4c31f2f78678acbc8262881

    • SHA256

      2f848ea94d4a48694c68e472882222c054d12797c0f7eabd7ebdb9daebd27ece

    • SHA512

      9af05fe8d4b2ecb0abcc3283af18950912cc0888bc1a98b3f9164cd839c41ddf6a2dea2c62dfcaaf8b53dac0eb8255ef6527e3f81f6908677d1ed5bce557e917

    Score
    10/10
    spywarestealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks