General
- Target app-hub-desk_7.3.3.zip
- Size 103.6MB
- Sample260626-flshwsgz2s
- SHA256 7f71c18945cc60f0d5ce19ea61187d2f2db5be293082753fd7e2e6da9037c8e3
Malware Config
Targets
-
- Target CHANGELOG.md
- Size 137B
- SHA256 be217b9768ebbb5c34946811928f4e73e513e4124c089206eeee2274eb7506b2
Score3/10 -
- Target GitHubs.txt
- Size 38B
- SHA256 cbaac0bcb859fd3c01f7b88950c7cb86ce72210a3e14468c00e5c889c3c0516a
Score1/10 -
- Target app-hub-desk_7.3.3.exe
- Size 80KB
- SHA256 2eb8278210434ced87711889ba19582b7a104190310d2a06f0855a9cf5772d11
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target cmutil.dll
- Size 3.4MB
- SHA256 a0da2372aa189d3ecc5c4d9cc47f5bbd9c40050692030aef595cecda965a664e
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target model.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
Score1/10 -
- Target x86/config.json
- Size 3.8MB
- SHA256 78695d93aa5816a9286d98cd43fe3e91480f5e75c2f093cd0b9770063a0547fd
Score1/10 -
- Target x86/core.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
Score1/10 -
- Target x86/corel.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
Score1/10 -
- Target x86/logo.png
- Size 2KB
- SHA256 1ab5e48c00466566f48abae9f930d040ee769ef45533904fd39353d20abd1c0b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x86/obsidian-source.dll
- Size 95.0MB
- SHA256 a29daf1b537ab3cc653b62849348b8459e328b874b947f2d1a87b7b33dca09ac
Score1/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3