General
- Target Fn Accounts.txt
- Size 77.8MB
- Sample260730-b3ek5sxakb
- SHA256 6e12f2bca397f269c7f7fdabab3680df611369ac22dcbc6b43ae640e90637d90
Malware Config
Targets
-
- Target Fn Accounts.txt
- Size 77.8MB
- SHA256 6e12f2bca397f269c7f7fdabab3680df611369ac22dcbc6b43ae640e90637d90
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Looks for VirtualBox drivers on disk
-
Looks for VMWare drivers on disk
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1File and Directory Discovery
2Process Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2