General
- Target Nuke-Void-1.9.zip
- Size 570KB
- Sample260723-jwvb1sad42
- SHA256 cca7345064d86eab6e042e310839cfdde59d141f0f7d7110de0e5920897c716c
Score
7/10
Malware Config
Targets
-
- Target Application.bat
- Size 23B
- SHA256 a91b3308a7e9aa9fa660c72d27f226d8f50bfac2629f79a828fbecff323c0fe0
Score7/10-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target buff.log
- Size 301KB
- SHA256 3989cdf958d258244f3a72bac594214112ffe1008d4d81233a5911482dd302ca
Score3/10 -
- Target load.exe
- Size 852KB
- SHA256 167b166e26dd44f580a00f2c879089c5362eff5120ac88e0701b11b1eb320ca9
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1