General
- Target Loader.exe
- Size 84.4MB
- Sample250119-w67fjszpbw
- SHA256 02c0e7ecdff08001d32761092607ecc1e43de001ed1f5179621919c53b65af0d
Score
8/10
Malware Config
Targets
-
- Target Loader.exe
- Size 84.4MB
- SHA256 02c0e7ecdff08001d32761092607ecc1e43de001ed1f5179621919c53b65af0d
Score8/10-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target client_scared_work.pyc
- Size 10KB
- SHA256 5b4c2f17c04c9c94c269712531d8979adf3bba17fa255f7396b2f58a23365ccc
Score3/10
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Component Object Model Hijacking
1Modify Authentication Process
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1