General
-
Target
PFNQO_Built.exe
-
Size
6.9MB
-
Sample
241028-wz7gzasnh1
-
MD5
f608b4a977d9fbabd3b4f1fb94f5e8aa
-
SHA1
fa99034e7994d2440df59617436a80c849ad3e41
-
SHA256
9c9359b1e64af13be987bbe341c7016694a2cfd9aa8e9a3287f2ea334d53f4b6
-
SHA512
14e6df90d1339d1f50280079144cab5a612860c1e12dddb5307e7579eeb0ccbe419889abe5bfcdd32622ab14869d4f8fe45e9e0ea859f8058a7c795b3d58eaeb
-
SSDEEP
98304:NHDjWM8JEE1rTCamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFW:NH0j7eNTfm/pf+xk4dWRptrbWOjgr5
Malware Config
Targets
-
-
Target
PFNQO_Built.exe
-
Size
6.9MB
-
MD5
f608b4a977d9fbabd3b4f1fb94f5e8aa
-
SHA1
fa99034e7994d2440df59617436a80c849ad3e41
-
SHA256
9c9359b1e64af13be987bbe341c7016694a2cfd9aa8e9a3287f2ea334d53f4b6
-
SHA512
14e6df90d1339d1f50280079144cab5a612860c1e12dddb5307e7579eeb0ccbe419889abe5bfcdd32622ab14869d4f8fe45e9e0ea859f8058a7c795b3d58eaeb
-
SSDEEP
98304:NHDjWM8JEE1rTCamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFW:NH0j7eNTfm/pf+xk4dWRptrbWOjgr5
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-