Overview

overview

8

Static

static

1

Invoice.exe

windows7-x64

8

Invoice.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    Invoice.rar

  • Size

    758KB

  • Sample

    230321-t3rjtaca24

  • MD5

    5ececd3b863cb974102ae4f6ffd2162a

  • SHA1

    11cf575e75cade8eea07bd9fac5acbde78a4f0b0

  • SHA256

    036d98d173fb619eb15bbd96049eadd630a39e1862e27440dc63b57e3896cb9f

  • SHA512

    7a8d4a72d42101a1d5b09c149a21d67a5383b80ff9de804fc7bf241f9a6a7cf98477f42892af3058f1e07944f73148e6cae4fe15411020a5c2566c01f6aa0a9c

  • SSDEEP

    12288:kjMfU5dDHYSp47jrMl6KZIpbD3b7dGpCec9MaBrxMKIfl0Ay7gpWvi3uT0a:mkuDHY/7jAlDebD3cCeVQtMKG0p7vv6e

Score
8/10
spywarestealer

Malware Config

Targets

    • Target

      Invoice.exe

    • Size

      919KB

    • MD5

      2eb2d005e9e53cee355efd983c28d2db

    • SHA1

      08df5dbf90f31c000b4ba06529b94da1ec3a4473

    • SHA256

      ae2e5e556f6fab620a62ed8dfe072e73ebff0a207177e48cb3b65253055205d4

    • SHA512

      a8bef4fcbff7e1fce9e7e81755cea88c16cc7ad02e4425f678e9a4ccdd9b1da5af3c837cde8c4d15a06fff8701ca784e1fd1d702c1eb6db586173b09d5df0af6

    • SSDEEP

      12288:N3Xo0cwqYwceebNpo45Tx4h7p70n8Zsg+Us827SwEVaCLhgiHEmYIOySza72rLnf:i0Wmfd4h7p1ss27SnUShRbh

    Score
    8/10
    spywarestealer

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks