Overview

overview

10

Static

static

3

RFQ March ...01.exe

windows7-x64

10

RFQ March ...01.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Forldreknu...ns.app

macos-10.15-amd64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c5938090abfb8afa9e2f364ca7f81a3a11ef78fca8299931e52b7e24393ffce.7z

  • Size

    575KB

  • Sample

    250220-dvra3svqhr

  • MD5

    73873fd4bf16a69988d6652fd6b6e8e7

  • SHA1

    bcae649956bad73645920ac55f767d3f5aa063ec

  • SHA256

    6c5938090abfb8afa9e2f364ca7f81a3a11ef78fca8299931e52b7e24393ffce

  • SHA512

    5968d260466458ed6fdef3e3c7cd7623cab69545e89151c2596c4f2aeeb643ca01b2bb74703892cdb71ab385d6c440db1f809fb8ad52a90ccd1064430a62afb9

  • SSDEEP

    12288:AqHUS2/qLVbhQp7OQQQv4YyL1xTD4oHLBhE8ZX6K+P72iWmFlp:xaHOQv4VL1GWK8ZXmyiNFT

Score
10/10
guloadercollectiondiscoverydownloadermacosspywarestealer

Malware Config

Targets

    • Target

      RFQ March order Ref 28101.exe

    • Size

      605KB

    • MD5

      1e3f98f846f1f269d07ed600aee399f0

    • SHA1

      40debddcfcd43f79475f1c1aa804c2724141638c

    • SHA256

      d6db00fc34f63f9f42baf31ce1a3b0450cd9182978872e61b45c2e2a2a246f85

    • SHA512

      93f08b7d92871c3b842ad9b4edec4543448d07172819d717a46d1daddde13f3d8de798fe025197d13d1a4ce8e183eab7b3f82778ded6e55b2189bb11e908de30

    • SSDEEP

      12288:ZfZ6QaYTUyLtXFyUU4etfo/lS5vaobgZFjjtHXbai1P4dXD:ZIdItXFPUVelS5imgZdjtWiR4h

    Score
    10/10
    guloadercollectiondiscoverydownloaderspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      75ed96254fbf894e42058062b4b4f0d1

    • SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

    • SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    • SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • SSDEEP

      192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Forldreknudernes/undervisningsformens.app

    • Size

      219KB

    • MD5

      2a79ab217485962274353ed00ad54303

    • SHA1

      5e8f0763b521c8b263fdaff95c303a472a1775cf

    • SHA256

      2d9886502fb73e1cbc90a03fbefaf0bb6f772dbdd75f112ba41dc627adbce86a

    • SHA512

      7961bbcd003bae4e57cc32decc174bd9f0244f857b3743161da94ede332d44f2383b442b93abf7974c7b3a905d9e9c641e228c215710d956574581bf8be9b22e

    • SSDEEP

      768:kBlm9DznOh98cy26g9o1Xr4e8akHVxAzP6osegfDg8CN:kB09nF26IE72DAbzsegfD/CN

    Score
    1/10
    behavioral5

MITRE ATT&CK Enterprise v15

Tasks