General
- Target reportsaccs.exe
- Size 18.8MB
- Sample260812-3ll3fafc98
- SHA256 6c37df31d27e6bd1baeb985ecaa4b9b3767b70076c9c7aa403b5c4f0e68fe0fd
Score
7/10
Malware Config
Targets
-
- Target reportsaccs.exe
- Size 18.8MB
- SHA256 6c37df31d27e6bd1baeb985ecaa4b9b3767b70076c9c7aa403b5c4f0e68fe0fd
Score7/10Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target stealer.pyc
- Size 41KB
- SHA256 c2e8124af2f3bf4fa17b834531078d1def7b6324137a7ea39544ac26bd5abfdc
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1