Resubmissions

29-11-2022 12:57

221129-p7blyadg5y 8

29-11-2022 12:51

221129-p3txqadd7z 8

General

  • Target

    Factcura_950960.rar

  • Size

    686KB

  • Sample

    221129-p7blyadg5y

  • MD5

    2027e09f2a8919f9e26314d6293490ef

  • SHA1

    b29e04bae6b75e9f685f03d7c60f64ef9306296d

  • SHA256

    3d5d6044734a18b4a78abaa64326d544e3e6aaa8a68f1e86a1fce05c1c90ade6

  • SHA512

    0187676e1ae85bf3caa90f502c9256e17be3e2404b8cb58706f670e4d0fba3930b52104e23f67802e0d87a6d7baa2d5abf51944db90912d55f393bd01c076362

  • SSDEEP

    12288:4+HU3fOSGj6mPduIGgRh/vN3HcR2RWSbvWPJBK95kq817c/l2eUXteocT:RHUPOelCHA2RzQJB/P1G2eUXteXT

Malware Config

Targets

    • Target

      doc_Factura.cmd

    • Size

      1.3MB

    • MD5

      c4cdec52d55e23afe4ef8eb489a3f606

    • SHA1

      b702aaa5ad698ff53bf78888bb7b091d98744dc2

    • SHA256

      8139c3fe860410dee6c76c9bc1ababc163043f9d4784ed468fe8a25a7c0eae41

    • SHA512

      ce170ac5758ab384e7973fceaa7911d2e0f74f74c4f552e665b3d0d96a63663f732384d0238da37d71feca028b605e134e58a673a855fa6d539b5761926586c8

    • SSDEEP

      24576:botxQMlJvK+rvgp20/sNerYDfUizKFfUsmldic5sgFaT0hA06t8:cQCi+klmDMkEVYmi

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks