General
- Target 748d04b04fea43adb36ed6c43ee65dc9.exe
- Size 2.9MB
- Sample260704-pfqa1saz7k
- SHA256 5bcd63edfe85569733cd75e76cb89fa3e9b3628694fa66e23e953a6724cb3ed9
Score
8/10
Malware Config
Targets
-
- Target 748d04b04fea43adb36ed6c43ee65dc9.exe
- Size 2.9MB
- SHA256 5bcd63edfe85569733cd75e76cb89fa3e9b3628694fa66e23e953a6724cb3ed9
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1