Overview

overview

9

Static

static

09f97ac411...63.exe

windows7_x64

9

09f97ac411...63.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09f97ac411f3674caaa4a4ad497f2d49bcb52881f3d5a57d816117d78f31be63

  • Size

    573KB

  • Sample

    220530-vbza1sgchl

  • MD5

    05d3649510dc5ee449505a910690d561

  • SHA1

    011a0717035d0fbda4d4997d3c32acb89db3fd34

  • SHA256

    09f97ac411f3674caaa4a4ad497f2d49bcb52881f3d5a57d816117d78f31be63

  • SHA512

    7a19eea16fe254c18706e5304204e880b5f01ca1c6de252cbea24f5999a321ab606e51a57028c11877a6f51e15f69718f89ea876c65e13b4381d6ebd05ff358b

Score
9/10
collection

Malware Config

Targets

    • Target

      09f97ac411f3674caaa4a4ad497f2d49bcb52881f3d5a57d816117d78f31be63

    • Size

      573KB

    • MD5

      05d3649510dc5ee449505a910690d561

    • SHA1

      011a0717035d0fbda4d4997d3c32acb89db3fd34

    • SHA256

      09f97ac411f3674caaa4a4ad497f2d49bcb52881f3d5a57d816117d78f31be63

    • SHA512

      7a19eea16fe254c18706e5304204e880b5f01ca1c6de252cbea24f5999a321ab606e51a57028c11877a6f51e15f69718f89ea876c65e13b4381d6ebd05ff358b

    Score
    9/10
    collection

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks