General
- Target SysHealthStrayX64.exe
- Size 21.7MB
- Sample260719-3bva3afw2l
- SHA256 4f1ffcf27098f5d6f9669b4999ebe6004f1e954c17b7fd0486a7f99a17e048bd
Score
8/10
Malware Config
Targets
-
- Target SysHealthStrayX64.exe
- Size 21.7MB
- SHA256 4f1ffcf27098f5d6f9669b4999ebe6004f1e954c17b7fd0486a7f99a17e048bd
Score8/10-
Adds policy Run key to start application
-
Drops file in Drivers directory
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers new Windows logon scripts automatically executed at logon.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target SysHealthStrayX64.pyc
- Size 158KB
- SHA256 7f390036cf9669bd17b7742148ebb9ff31e8f22328373dd5498fca5258dbed2a
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Boot or Logon Initialization Scripts
1Logon Script (Windows)
1