General
- Target Новый текстовый документ (13).txt
- Size 115B
- Sample261107-mt3r6abs3s
- SHA256 e61dacaf5437c542f9d827345fb070a317b5eff822535ae824185f00f9656f0a
Score
10/10
Malware Config
Targets
-
- Target Новый текстовый документ (13).txt
- Size 115B
- SHA256 e61dacaf5437c542f9d827345fb070a317b5eff822535ae824185f00f9656f0a
Score10/10Modifies Windows Defender DisableAntiSpyware settings
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Executes dropped EXE
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
1