General
- Target test-pull-v2.3.zip
- Size 565KB
- Sample260812-wtvafssblf
- SHA256 1312162e3d96c41901c73c586b3b0003f20a1abf28b33de9ac94cefdfec7a877
Score
7/10
Malware Config
Targets
-
- Target App.bat
- Size 23B
- SHA256 a91b3308a7e9aa9fa660c72d27f226d8f50bfac2629f79a828fbecff323c0fe0
Score7/10-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target buff.log
- Size 290KB
- SHA256 c7b71a992c6ca1467164b643136d986c0eec28548f30533456a3ea0f442c85a8
Score3/10 -
- Target load.exe
- Size 852KB
- SHA256 167b166e26dd44f580a00f2c879089c5362eff5120ac88e0701b11b1eb320ca9
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1