General

  • Target

    096d3d2393955d2a47a012c62cd95cb07184d6bee89a9d6beca2998c7ec85176.exe

  • Size

    208KB

  • Sample

    220930-vpsqdsfbcq

  • MD5

    73f02834b65a6cb93476a81e0fc7ce3f

  • SHA1

    fafdb2dbeecd8014ac100dcda3ff8b2c05c6b725

  • SHA256

    096d3d2393955d2a47a012c62cd95cb07184d6bee89a9d6beca2998c7ec85176

  • SHA512

    8df81c524c06cd6bd972755542df18ee39f355f6194128c51ea92da807951fa0a1f275d1a69f299361fb22bbf91b606f43118cd8c406bf6f007c3a26b3cd2b42

  • SSDEEP

    6144:Sh8TYHnViRdK79m5MPlUWLyHCXy7eL2j4XsWJLAISecoS:Sh8TcViRdKBVvH0ec

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.scooptechuae.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    scoop@1234

Targets

    • Target

      096d3d2393955d2a47a012c62cd95cb07184d6bee89a9d6beca2998c7ec85176.exe

    • Size

      208KB

    • MD5

      73f02834b65a6cb93476a81e0fc7ce3f

    • SHA1

      fafdb2dbeecd8014ac100dcda3ff8b2c05c6b725

    • SHA256

      096d3d2393955d2a47a012c62cd95cb07184d6bee89a9d6beca2998c7ec85176

    • SHA512

      8df81c524c06cd6bd972755542df18ee39f355f6194128c51ea92da807951fa0a1f275d1a69f299361fb22bbf91b606f43118cd8c406bf6f007c3a26b3cd2b42

    • SSDEEP

      6144:Sh8TYHnViRdK79m5MPlUWLyHCXy7eL2j4XsWJLAISecoS:Sh8TcViRdKBVvH0ec

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks