General
- Target components-cache-granular-v2.1.zip
- Size 476KB
- Sample260729-w7glhsch93
- SHA256 e3505db28fd02b16be248211984c3dacb7d157887fe2ca189e3ec6a604182a29
Score
7/10
Malware Config
Targets
-
- Target App.bat
- Size 29B
- SHA256 a96ffc9f649333f9e84b7a7e1101cf85f7a5f143253db1d7853e6e48d46b3c72
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target icon16.txt
- Size 289KB
- SHA256 33250ded61c43128b6c29b01de7b1cc962b241b236933f54bc42b648afae2398
Score3/10 -
- Target lua51.dll
- Size 381KB
- SHA256 c740061da4971cdf36a102637f80fc23dbff5769c1ec2156fcd90764237d51e2
Score1/10 -
- Target resolver.exe
- Size 282KB
- SHA256 8fa25c75ee56eb3c4a2b0a6fe056c1e9f933e00596c6e3167e4727f01828168d
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1