General

  • Target

    538f7ff02b9ccb2a61f24e7802fb4db3ae51823c348e4b577ce7471af8e944e8

  • Size

    44KB

  • Sample

    221127-wa1ccsfc39

  • MD5

    83616967dde9bc57b39119144e35d3dd

  • SHA1

    d12364e5b36e4dd0e6cd1c25f68ebba5553ef89c

  • SHA256

    538f7ff02b9ccb2a61f24e7802fb4db3ae51823c348e4b577ce7471af8e944e8

  • SHA512

    d2f39e6b318adbcc51d2d4583544acbc14c5eda7d647ab379f1dd93e24d511fa5bf5aa93a8add60e0495cf8e66c13bca3295d7d6168d26fdeca8269d8cc1ed1e

  • SSDEEP

    384:GvinQ0LSf0dWQDfWBsWUPsUcUQfLTtyvW9GZ6OtO/Xa2BfieU1o:ZnycNTusWWcUQiIOtO/XaMU1o

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kurdistan1

Targets

    • Target

      538f7ff02b9ccb2a61f24e7802fb4db3ae51823c348e4b577ce7471af8e944e8

    • Size

      44KB

    • MD5

      83616967dde9bc57b39119144e35d3dd

    • SHA1

      d12364e5b36e4dd0e6cd1c25f68ebba5553ef89c

    • SHA256

      538f7ff02b9ccb2a61f24e7802fb4db3ae51823c348e4b577ce7471af8e944e8

    • SHA512

      d2f39e6b318adbcc51d2d4583544acbc14c5eda7d647ab379f1dd93e24d511fa5bf5aa93a8add60e0495cf8e66c13bca3295d7d6168d26fdeca8269d8cc1ed1e

    • SSDEEP

      384:GvinQ0LSf0dWQDfWBsWUPsUcUQfLTtyvW9GZ6OtO/Xa2BfieU1o:ZnycNTusWWcUQiIOtO/XaMU1o

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks