Resubmissions

21-11-2024 14:16

241121-rldwaaxlap 10

21-11-2024 14:15

241121-rknzvstbmk 6

General

  • Target

    https://drive.google.com/file/d/11w4DvSBfEF35-wo8zMPGY_00pj-Av-10/view?usp=drivesdk

  • Sample

    241121-rldwaaxlap

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    juye mmds bjab mjcm

Targets

    • Target

      https://drive.google.com/file/d/11w4DvSBfEF35-wo8zMPGY_00pj-Av-10/view?usp=drivesdk

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks