General
- Target fo4translator.exe
- Size 2.8MB
- Sample260505-wy896sds91
- SHA256 549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7
Malware Config
Targets
-
- Target fo4translator.exe
- Size 2.8MB
- SHA256 549a26874eb9a1ec254d989eb98039d3b86bc90fb66f6f78bb84a814afddafc7
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2File/Path Exclusions
1Hidden Window
1Impair Defenses
1Disable or Modify Tools
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3