General
- Target da923b960ed2453887da432232788ceef46bd0ea60a9691d9b36e3191da99220.zip
- Size 4.3MB
- Sample260825-vb1h3ssxc1
- SHA256 516248198001676d8e065ea197cf40fa39b1b611743270449df4e11f98956795
Malware Config
Targets
-
- Target da923b960ed2453887da432232788ceef46bd0ea60a9691d9b36e3191da99220
- Size 10.8MB
- SHA256 da923b960ed2453887da432232788ceef46bd0ea60a9691d9b36e3191da99220
Score8/10-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1