Overview

overview

10

Static

static

Please upd...on.pdf

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Please update your payment information.pdf

  • Size

    194KB

  • Sample

    200529-nx8pswv9fj

  • MD5

    a7528ce286802989fad9103628e8b7dc

  • SHA1

    9c4a67ec2cfea973ac51cf4ff59879491d233c5f

  • SHA256

    19aa636d88edf0fe62c32ab27bbc19ddef26cba4d9117a681f62b14ebccd016b

  • SHA512

    2699f06645f47de268cd224e460a3b4d204f71473ff00af703a2e7ffc3e04b93abca62dbf6856abc33c12a059dd82901a23e6829059b4f6514da959cf296c7a3

Score
10/10
spyware

Malware Config

Targets

    • Target

      Please update your payment information.pdf

    • Size

      194KB

    • MD5

      a7528ce286802989fad9103628e8b7dc

    • SHA1

      9c4a67ec2cfea973ac51cf4ff59879491d233c5f

    • SHA256

      19aa636d88edf0fe62c32ab27bbc19ddef26cba4d9117a681f62b14ebccd016b

    • SHA512

      2699f06645f47de268cd224e460a3b4d204f71473ff00af703a2e7ffc3e04b93abca62dbf6856abc33c12a059dd82901a23e6829059b4f6514da959cf296c7a3

    Score
    10/10
    spyware

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Program crash

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks