General
- Target mhr7cu3.exe
- Size 4.6MB
- Sample260109-vk3pssbv5e
- SHA256 e81ae87e94af46bdadf5fe18fd3bcd8e3d6a168e026bcfd1368750cf138c7e6b
Score
8/10
Malware Config
Targets
-
- Target mhr7cu3.exe
- Size 4.6MB
- SHA256 e81ae87e94af46bdadf5fe18fd3bcd8e3d6a168e026bcfd1368750cf138c7e6b
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
3Credentials In Files
3