General
- Target mpclient.dll
- Size 4.6MB
- Sample260627-t951saby4y
- SHA256 3ccbd54fd6fdc48aa373f711e5605d4dc43ed0ffd889affc3a6f54a121f0fb1c
Score
10/10
Malware Config
Targets
-
- Target mpclient.dll
- Size 4.6MB
- SHA256 3ccbd54fd6fdc48aa373f711e5605d4dc43ed0ffd889affc3a6f54a121f0fb1c
Score10/10Suspicious use of NtCreateProcessExOtherParentProcess
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1