General
- Target 05082026_0708_04082026_Application.cmd.zip
- Size 477KB
- Sample260805-hyd75sfe49
- SHA256 0765bf441b287ca4b3ea44b9079779c6d58311dd33b5ab1f708cdb6b136c9871
Score
7/10
Malware Config
Targets
-
- Target Application.cmd
- Size 33B
- SHA256 24cdfb100ad9f06798f0c21f5912a98f0c954ffb3477adae9cf86e8521b999f2
Score7/10-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target certificate.txt
- Size 193KB
- SHA256 36e442288d9e9769972b8baf3eb6a71f5ef6d5120345d076d56c8e7cc803106b
Score3/10 -
- Target utility.exe
- Size 742KB
- SHA256 e227d47facf0e2f5b9e5c54a23a86b31272696b64bbbb9932a31fe06973677bd
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2