General
-
Target
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
-
Size
121KB
-
Sample
240417-r1t6tadh61
-
MD5
963882fd8e183b937bf5f3352acb82f1
-
SHA1
3ed03c2fd2dee0903bf254773ec9a444cd8990a4
-
SHA256
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
-
SHA512
23e4dc2b289bdeab55c6f9794d3801e66bb182850949c31f61a174e60b7d2a50230fd494fb4a53be7ddd9200bd01f082a57f53acc6e9e5d728f8ee8356f79280
-
SSDEEP
1536:dWRhi+kHYYBuPIXtbNN08g+vB59bFmki3zMEFUVEQqFtelOYWNO3bpSWKLkP:2k4CuQe0D9bFmkyeOE38WKLkP
Malware Config
Targets
-
-
Target
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
-
Size
121KB
-
MD5
963882fd8e183b937bf5f3352acb82f1
-
SHA1
3ed03c2fd2dee0903bf254773ec9a444cd8990a4
-
SHA256
2e49688556ab4509a057fef58003b9faa39fea201c5c18e248faba4b4f5a9161
-
SHA512
23e4dc2b289bdeab55c6f9794d3801e66bb182850949c31f61a174e60b7d2a50230fd494fb4a53be7ddd9200bd01f082a57f53acc6e9e5d728f8ee8356f79280
-
SSDEEP
1536:dWRhi+kHYYBuPIXtbNN08g+vB59bFmki3zMEFUVEQqFtelOYWNO3bpSWKLkP:2k4CuQe0D9bFmkyeOE38WKLkP
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-