General

  • Target

    85c482b7adbacc9368a0bc9ba99da9f49037270c

  • Size

    446KB

  • Sample

    230112-xvg7yshg44

  • MD5

    18446141ac9b9a4b41763f8cf429318c

  • SHA1

    85c482b7adbacc9368a0bc9ba99da9f49037270c

  • SHA256

    785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9

  • SHA512

    b9e35d1a26432593fb3e53865bbf3a378b7712a8082f200f2408a938162eb32546693762bd25b100957c811b4c3d2891c8a176b4b83674ad0ba8fe158245a26a

  • SSDEEP

    12288:IYg1KH0frXRHMYTh1SSh9HVL7WwknPANzmRj:IYmzfrXRHvh1SSrZ7pkPAIN

Malware Config

Targets

    • Target

      85c482b7adbacc9368a0bc9ba99da9f49037270c

    • Size

      446KB

    • MD5

      18446141ac9b9a4b41763f8cf429318c

    • SHA1

      85c482b7adbacc9368a0bc9ba99da9f49037270c

    • SHA256

      785d95955d4b6874b8af4dcfc1b75bcad1029ff37aeea13525cfd9295f1a5ee9

    • SHA512

      b9e35d1a26432593fb3e53865bbf3a378b7712a8082f200f2408a938162eb32546693762bd25b100957c811b4c3d2891c8a176b4b83674ad0ba8fe158245a26a

    • SSDEEP

      12288:IYg1KH0frXRHMYTh1SSh9HVL7WwknPANzmRj:IYmzfrXRHvh1SSrZ7pkPAIN

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks