General
-
Target
INV_QTYD33_of 2020-ASIA CITRA PRATAMA -AIRO 34-20_pdf.exe
-
Size
223KB
-
Sample
200630-32fyp3mbsj
-
MD5
0b89e3e11d64e96a9eb841c297c3e795
-
SHA1
ee91492d04556958af32986a5f235a4c528c9178
-
SHA256
c8fbdfebce02c75b83f14b5706f8b874435c33d48cc868bf046f13fe3dfad98d
-
SHA512
d91acd5c4b45ef6b7f5a6a006c74e067e193bbac6beef17f5c8893fbed0e6f40d3cde335b21f1068a48f5ba6e4164616d568dcab58bb306c18a5fada16aed690
Static task
static1
Behavioral task
behavioral1
Sample
INV_QTYD33_of 2020-ASIA CITRA PRATAMA -AIRO 34-20_pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
INV_QTYD33_of 2020-ASIA CITRA PRATAMA -AIRO 34-20_pdf.exe
Resource
win10
Malware Config
Targets
-
-
Target
INV_QTYD33_of 2020-ASIA CITRA PRATAMA -AIRO 34-20_pdf.exe
-
Size
223KB
-
MD5
0b89e3e11d64e96a9eb841c297c3e795
-
SHA1
ee91492d04556958af32986a5f235a4c528c9178
-
SHA256
c8fbdfebce02c75b83f14b5706f8b874435c33d48cc868bf046f13fe3dfad98d
-
SHA512
d91acd5c4b45ef6b7f5a6a006c74e067e193bbac6beef17f5c8893fbed0e6f40d3cde335b21f1068a48f5ba6e4164616d568dcab58bb306c18a5fada16aed690
Score8/10-
Executes dropped EXE
-
Sets DLL path for service in the registry
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Modifies WinLogon
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-