General
-
Target
Boootstrapper.exe
-
Size
6.0MB
-
Sample
240809-tn7x9awfqe
-
MD5
a2d21b6d07f5c1827897f8125718f7f4
-
SHA1
1a35bfb7f2db614525995dd24665f39e0f3b9921
-
SHA256
b97b35a33903100e7ffc8b6e9924812a7ee5ff90c1c9b891acf954eaa454f426
-
SHA512
806b12130d00933e5cfee095a5a4713f423c1d06f41fbac611f8421a09553b97960b28a244e8ca6711d9e4fc40481a0ee8cf1771edad7790383f56985d3c515a
-
SSDEEP
98304:DeIu4+DcBkjamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HHM7c3M1uC:DVp+DaeNoInY7/sHfbRy9s7tdt
Malware Config
Targets
-
-
Target
Boootstrapper.exe
-
Size
6.0MB
-
MD5
a2d21b6d07f5c1827897f8125718f7f4
-
SHA1
1a35bfb7f2db614525995dd24665f39e0f3b9921
-
SHA256
b97b35a33903100e7ffc8b6e9924812a7ee5ff90c1c9b891acf954eaa454f426
-
SHA512
806b12130d00933e5cfee095a5a4713f423c1d06f41fbac611f8421a09553b97960b28a244e8ca6711d9e4fc40481a0ee8cf1771edad7790383f56985d3c515a
-
SSDEEP
98304:DeIu4+DcBkjamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HHM7c3M1uC:DVp+DaeNoInY7/sHfbRy9s7tdt
Score9/10-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-