General
-
Target
EXM_Premium_Tweaking_Utility_1.0_Cracked.bat
-
Size
469B
-
Sample
241121-3tapdaznbs
-
MD5
8c1a6acb0cf4efaea77c25de80dad5d6
-
SHA1
28a858f732ce50193e5c24b3c26f8ac59957f078
-
SHA256
6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1
-
SHA512
84ef0ba97c9a4f7a48016905a816b5cd83ad4e862eb20cac2b8e82ef42ecdc54f40aa485ae8fccf6b96bbb0ec890ffac0fbb0bf8289389d6b77ca2469d29c7bd
Malware Config
Targets
-
-
Target
EXM_Premium_Tweaking_Utility_1.0_Cracked.bat
-
Size
469B
-
MD5
8c1a6acb0cf4efaea77c25de80dad5d6
-
SHA1
28a858f732ce50193e5c24b3c26f8ac59957f078
-
SHA256
6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1
-
SHA512
84ef0ba97c9a4f7a48016905a816b5cd83ad4e862eb20cac2b8e82ef42ecdc54f40aa485ae8fccf6b96bbb0ec890ffac0fbb0bf8289389d6b77ca2469d29c7bd
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1