General

  • Target

    97a770a44b477cc3def188a3a7b7dbb58d75c0e3

  • Size

    167KB

  • Sample

    230201-qh7thsge5y

  • MD5

    f055eed37cfc5e0280520f1d46050400

  • SHA1

    97a770a44b477cc3def188a3a7b7dbb58d75c0e3

  • SHA256

    73f8f4b1fab2eeb0135f6207c88a0d5f7f8a5390ddd3f30403b7431ada2be289

  • SHA512

    7ba06bd367ae94f38470ebd13caace86c5b9cae547189fa888557cab1fd62789c693c6cfc72755da901a966e5fbb9dd527f6bcad1adff61f61c4f8dd710475a6

  • SSDEEP

    3072:iFgNR++gYRnis+XMK64ksvsJh94liUQ7hfbsrRijOd3j:iFeX1b2E1UQ7hfbmsSx

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    nPrbBT)8nPrbBT)8

Targets

    • Target

      97a770a44b477cc3def188a3a7b7dbb58d75c0e3

    • Size

      167KB

    • MD5

      f055eed37cfc5e0280520f1d46050400

    • SHA1

      97a770a44b477cc3def188a3a7b7dbb58d75c0e3

    • SHA256

      73f8f4b1fab2eeb0135f6207c88a0d5f7f8a5390ddd3f30403b7431ada2be289

    • SHA512

      7ba06bd367ae94f38470ebd13caace86c5b9cae547189fa888557cab1fd62789c693c6cfc72755da901a966e5fbb9dd527f6bcad1adff61f61c4f8dd710475a6

    • SSDEEP

      3072:iFgNR++gYRnis+XMK64ksvsJh94liUQ7hfbsrRijOd3j:iFeX1b2E1UQ7hfbmsSx

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks