General

  • Target

    7984f74486d3ea0408c80b7474d555b4a2fe5cc9982d8468bd3887a8dbef22b7

  • Size

    1.7MB

  • Sample

    220521-mjt29sbgh7

  • MD5

    3105ff0da15084f3d6496bdff22544c9

  • SHA1

    43d169e19ac3e9bd602136bb3230159df5015b6d

  • SHA256

    7984f74486d3ea0408c80b7474d555b4a2fe5cc9982d8468bd3887a8dbef22b7

  • SHA512

    47287af8ccb92a873fa56dc697b371bcc31fc29ab9b3b89a1ccb6fec2a2713557a6f6ea35fcb9f9c0dd8e1f6679465368ef2ee61e1e8df30b8e0c35c936afd75

Malware Config

Targets

    • Target

      7984f74486d3ea0408c80b7474d555b4a2fe5cc9982d8468bd3887a8dbef22b7

    • Size

      1.7MB

    • MD5

      3105ff0da15084f3d6496bdff22544c9

    • SHA1

      43d169e19ac3e9bd602136bb3230159df5015b6d

    • SHA256

      7984f74486d3ea0408c80b7474d555b4a2fe5cc9982d8468bd3887a8dbef22b7

    • SHA512

      47287af8ccb92a873fa56dc697b371bcc31fc29ab9b3b89a1ccb6fec2a2713557a6f6ea35fcb9f9c0dd8e1f6679465368ef2ee61e1e8df30b8e0c35c936afd75

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks