General
- Target app-VTSQ688T.zip
- Size 125.1MB
- Sample261107-3kshtsgw5q
- SHA256 aa795051700f9a6d3a1e4b847ef1088502d028cd0d99366fc202431b78380002
Score
8/10
Malware Config
Targets
-
- Target app-VTSQ688T.zip
- Size 125.1MB
- SHA256 aa795051700f9a6d3a1e4b847ef1088502d028cd0d99366fc202431b78380002
Score1/10 -
- Target 156.0.8078.48.manifest
- Size 226B
- SHA256 1e02a4dfe815d293d35e2317146f4d825c4ae48d634b32ca8e6ffbb824a9a409
Score3/10 -
- Target chrome_elf.dll
- Size 723KB
- SHA256 f5893725a2edc4cbb921ae1f7003df2bafd14781e6b5ae137cc3e8ac95fb5fa6
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of SetThreadContext
-
- Target data.bin
- Size 119.1MB
- SHA256 83733aef538ad6a9cc8c9783ec436d53f803295b04bc0ce4f278ac8673787b1c
Score3/10 -
- Target setup.exe
- Size 4.3MB
- SHA256 480f275b63d1ea39113cbc8344ac395578acc25b432bd39af5fbc77005179aca
Score7/10Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
-
- Target sqlite3.dll
- Size 1.0MB
- SHA256 7e45813f820fafe73792d2b384254835bee1f6dbddb70ed7de4e57a08be52d49
Score1/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3