General
- Target dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
- Size 652KB
- Sample240521-rlpyjsgg74
- SHA256 a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f
Score
10/10
Malware Config
Targets
-
- Target dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe
- Size 652KB
- SHA256 a7a04842ca3e817e5ae28cf389f590ba2a4f76c63e25249419bad63277b7312f
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 9b93c61c9d63ef8ec80892cc0e4a0877966dca9b0c3eb85555cebd2ddf4d6eed
Score3/10