Overview

overview

7

Static

static

file-10101231_pdf.exe

windows7_x64

7

file-10101231_pdf.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c883620f8d94cb4df37dcd345fdbe54e3bc08ab5e8fdae48be1eb74c74401365

  • Size

    291KB

  • Sample

    220521-mybt8scfe7

  • MD5

    7a24fee4eb1887ab4ebc055f066b8ac9

  • SHA1

    9c784e43cdedd823ef9d25ac7bcf683776e3a7f3

  • SHA256

    c883620f8d94cb4df37dcd345fdbe54e3bc08ab5e8fdae48be1eb74c74401365

  • SHA512

    0d82fafc47ba84e2c1aa8aed8dc52d55c6bb1e697c1d4497957a85c5b29831b3c1529293112223ee1070aff5da85551036590eb3c6210bef4cb34e74592d0fc3

Score
7/10
collectionpersistencespywarestealer

Malware Config

Targets

    • Target

      file-10101231_pdf.exe

    • Size

      510KB

    • MD5

      e07de03d1978041647c10e75b7eb7389

    • SHA1

      87d3a9bdbbf7ef6c0bdd7a81682c7316dfa0d7c8

    • SHA256

      0776457840077a9b6ac113b23ebf60c224c3c7b4807c6698fdfe764531d285be

    • SHA512

      6e9a6d92166328b87e898f320d660f9ee9452756717476fda1f5fbb2b17ab7b4029d9a8621ecb63990ca862f4b35a3a2796b3067c68f6a81b6c96641f46b824c

    Score
    7/10
    collectionpersistencespywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks