General

  • Target

    DHL Invoice_UTJU1GTKE.exe

  • Size

    816KB

  • Sample

    230724-gvlblsag8t

  • MD5

    cfa11d0ca5431483e455233e003a3609

  • SHA1

    06e622d802ef9dfe6582cb75e4076d5749d50b65

  • SHA256

    81a48f67c7805ecf8ee47f17999208a9a116fca844d8dff8dbf12f66f4c91445

  • SHA512

    e08a164355b6a483b14e6c24fffa160bc424ff5ddaf72f79328dee91ca98e93eb1062a262cf8e58fd06b9b743af1ba02aa4e1259c88b6e488aeffc1082584957

  • SSDEEP

    12288:jevJRBusyO3oXl4UVSZiIC38gOBJcqVuHppBJLZEZjtjq0y+Oq:UFuHl4UVS7G8gUcqyWjtumOq

Malware Config

Targets

    • Target

      DHL Invoice_UTJU1GTKE.exe

    • Size

      816KB

    • MD5

      cfa11d0ca5431483e455233e003a3609

    • SHA1

      06e622d802ef9dfe6582cb75e4076d5749d50b65

    • SHA256

      81a48f67c7805ecf8ee47f17999208a9a116fca844d8dff8dbf12f66f4c91445

    • SHA512

      e08a164355b6a483b14e6c24fffa160bc424ff5ddaf72f79328dee91ca98e93eb1062a262cf8e58fd06b9b743af1ba02aa4e1259c88b6e488aeffc1082584957

    • SSDEEP

      12288:jevJRBusyO3oXl4UVSZiIC38gOBJcqVuHppBJLZEZjtjq0y+Oq:UFuHl4UVS7G8gUcqyWjtumOq

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks