Overview

overview

10

Static

static

6fd799e64e...8f.exe

windows7_x64

10

6fd799e64e...8f.exe

windows10-2004_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fd799e64e98e19e4fb4f82c62b673e389e7c4682368f7a3d88a723e241da68f

  • Size

    1.0MB

  • Sample

    220309-t8h5maaga5

  • MD5

    5e8183e3395b2c6c6ac39d40d28f3f8a

  • SHA1

    f51db7e5d9dd7de25ee9b094a25a2fa593e8040d

  • SHA256

    6fd799e64e98e19e4fb4f82c62b673e389e7c4682368f7a3d88a723e241da68f

  • SHA512

    be4138a2672d98822ec75b6892cd84120b2aee166bd332d961db812e8acd0c60f53fb7626aa29192304fcf6d9c1de09197959cd477d95c34c7a761fe5142731a

Score
10/10
collectiondiscoveryspywarestealerupx

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mail.com
  • Port:
    587
  • Username:
    diplomat.thomasfletcher@post.com
  • Password:
    Lordcardo31

Targets

    • Target

      6fd799e64e98e19e4fb4f82c62b673e389e7c4682368f7a3d88a723e241da68f

    • Size

      1.0MB

    • MD5

      5e8183e3395b2c6c6ac39d40d28f3f8a

    • SHA1

      f51db7e5d9dd7de25ee9b094a25a2fa593e8040d

    • SHA256

      6fd799e64e98e19e4fb4f82c62b673e389e7c4682368f7a3d88a723e241da68f

    • SHA512

      be4138a2672d98822ec75b6892cd84120b2aee166bd332d961db812e8acd0c60f53fb7626aa29192304fcf6d9c1de09197959cd477d95c34c7a761fe5142731a

    Score
    10/10
    collectiondiscoveryspywarestealerupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks