Overview

overview

8

Static

static

doc-Impostos.cmd

windows7-x64

8

doc-Impostos.cmd

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    doc-Impostos_203272.rar

  • Size

    690KB

  • Sample

    230102-qbvwdaec58

  • MD5

    c42005d37c5d6041e5a8d55d0f0a557f

  • SHA1

    bfc65b38aca12ea0b05bda5636cec1154fbaeaf7

  • SHA256

    98de383a4e73adebc37457e630a1268c2379d8bbe8349e3d6cd28d8dbfecd3e6

  • SHA512

    9a0a45a23fdc1044d9e28616e98fe83acb13e28f4afb64811c13292cab06871b882f35576043fbbc6d8fbf57f50ec9576baccff56b6347fa67011c7faa4ebe7a

  • SSDEEP

    12288:vJhX/EoJBEdmOGSzUm3uzRlsyqz+Atbw+1L/+hAY0KlcQcAVUSP/8X59NP98rC/q:vJjBEdhZ3uzRlwCAtMUAAYPcQhfn8J96

Score
8/10
collectionspywarestealer

Malware Config

Targets

    • Target

      doc-Impostos.cmd

    • Size

      1.4MB

    • MD5

      c76daaa1b0caaf00f820581c3d848581

    • SHA1

      279e002d57cf3dfa1faa4a5d22d77c6b29fe9f6c

    • SHA256

      7ff62cc43a03065fe50371080e849b0779cb0f1ec308b24eca6b5ce1bf6b6ad3

    • SHA512

      01f8a45568d0b508d09609e0659bb332a3509944039208bfc9ca18f66a63a179a7119aad54d92a514cb3962d3801459f3a527984a2e4c4c6b30063e1a55ec471

    • SSDEEP

      24576:0b0FVefPot0YZeHsCrhGbfAjespJNj5e1byXc628L:to45oeuIQtL

    Score
    8/10
    collectionspywarestealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks