General
- Target VanishBit-Setup.exe
- Size 23.1MB
- Sample260708-pf2n2sft5s
- SHA256 d8fc2c7e2207a01df35518cb0bdc7e59af3d31de0707aee8ee8858712257f637
Score
8/10
Malware Config
Targets
-
- Target VanishBit-Setup.exe
- Size 23.1MB
- SHA256 d8fc2c7e2207a01df35518cb0bdc7e59af3d31de0707aee8ee8858712257f637
Score4/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target VanishBit.exe
- Size 23.1MB
- SHA256 0f7a2f5dbccb4204038093190616d42dabd8036e858562ce6d9b699eb93a5163
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4