General
- Target e4eae60e94508ef4d6d731be014afe6dd143b5b683e4cd9459d84db208249648.gz
- Size 418KB
- Sample240625-cc2tesxgrq
- SHA256 e4eae60e94508ef4d6d731be014afe6dd143b5b683e4cd9459d84db208249648
Score
10/10
Malware Config
Targets
-
- Target SCAN00381638.vbe
- Size 646KB
- SHA256 411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Detects executables built or packed with MPress PE compressor
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext