General
- Target RMS RFQ#2110474566500464 202407231.docx.com.exe
- Size 537KB
- Sample240731-mdncjasepg
- SHA256 fed0ecd2eaf8028eddfefd92b374bf515059a07daf18f30fb1e4faf9b1d4c3c2
Score
10/10
Malware Config
Targets
-
- Target RMS RFQ#2110474566500464 202407231.docx.com.exe
- Size 537KB
- SHA256 fed0ecd2eaf8028eddfefd92b374bf515059a07daf18f30fb1e4faf9b1d4c3c2
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
Score3/10 -
- Target Thaiens.Scr
- Size 416KB
- SHA256 b0d6688bfee97fb0d32b20434f85a71d80ba47311fe538c3d38547fdf7838af6
Score1/10