8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507

General

Target
8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
Size 858KB
Sample241111-c8vd8atrhl
SHA256 8855ef55076566f0a90f36a1bdad52c28388ff9e6dc599e117b7cfc68c2f9507
MD5 e53c224cfc4e44d9ee530887e651b99b
SHA1 2ad901d2166ec55731e940a275c2d842dc471eab
SHA512 41fb500f8dc31ff80354d54059b74b900ee840a2b3422313d75d62b7a5f003de6a63b7c669a020518af4e4d9f407f4ab4429e2e043c65f63500df70d059e2f06
SSDEEP 12288:PYOWW2tE3dKP+V32LHwoWJo7SA/j9Org1MC4XCp1PBXATjIw3dL4UPUP5KtqAqu+:PYO2+mn2JoN7Ggy8FAj3RdbcOf3jjOJV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  payment confirmation.exe
- Size 926KB
- SHA256 cb62c5a32d65e57b523d60844334f410be45956464553dabade26b62182df4af
- MD5 70113c7be193321950485142c8791a7c
- SHA1 95310aa0c9e5ccc3e5fdd001df09653889c33b63
- SHA512 9708c2c2056b00b5bf43af014534354fe839b22f2353563e961da9b4d487cedd6fbb49f325e60e863b81ceeda8a40236f149ceee03f268b3196baae8b971a0ed
- SSDEEP 24576:nf+iN57Gtene3YSySHurVZBDSGfPNZqJ4:fLXKtene3YSjuhzfVZqJ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

collection discovery upx
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops startup file

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2