General
- Target Booster-Arc-FP-Raiders-3.5.zip
- Size 570KB
- Sample260624-pegbqaby31
- SHA256 6f6e834e9810adf64050a599f595dfd981c7030019ec9c4800a18444e52121c2
Score
7/10
Malware Config
Targets
-
- Target Application.bat
- Size 23B
- SHA256 a91b3308a7e9aa9fa660c72d27f226d8f50bfac2629f79a828fbecff323c0fe0
Score7/10-
Executes dropped EXE
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target buff.log
- Size 301KB
- SHA256 3989cdf958d258244f3a72bac594214112ffe1008d4d81233a5911482dd302ca
Score3/10 -
- Target load.exe
- Size 852KB
- SHA256 167b166e26dd44f580a00f2c879089c5362eff5120ac88e0701b11b1eb320ca9
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2