General
- Target https://cdn.discordapp.com/attachments/1351211899399831564/1530336966594400366/Launcher_3.exe?ex=6a6534dd&is=6a63e35d&hm=891a8a2e49cca1f92102335392e287b58ae4323ee2dcdb3c6900f78cf8073075&
- Sample260724-1559baee23
Score
8/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1351211899399831564/1530336966594400366/Launcher_3.exe?ex=6a6534dd&is=6a63e35d&hm=891a8a2e49cca1f92102335392e287b58ae4323ee2dcdb3c6900f78cf8073075&
Score8/10-
Downloads MZ/PE file
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Authentication Process
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1