General

  • Target

    Shipment Documents PL&BL Draft img.exe

  • Size

    591KB

  • Sample

    200630-6kdzkev7b2

  • MD5

    055ec8209736da7ea8ae8a2dd314feee

  • SHA1

    3af70c9b799a9719b19935c38ec64b4cacbda211

  • SHA256

    1955d466452cd025985e7bfff38c2c02bd9000a50c47d75ac4d9303a726c074e

  • SHA512

    7744bc1058bcdf3682d20af3b5f967eafb52ecf6589fae71446734ff487e63e5157834993f1ad05636204dea70c629601765e356d90e2e25afc9e3141b42ac89

Score
7/10

Malware Config

Targets

    • Target

      Shipment Documents PL&BL Draft img.exe

    • Size

      591KB

    • MD5

      055ec8209736da7ea8ae8a2dd314feee

    • SHA1

      3af70c9b799a9719b19935c38ec64b4cacbda211

    • SHA256

      1955d466452cd025985e7bfff38c2c02bd9000a50c47d75ac4d9303a726c074e

    • SHA512

      7744bc1058bcdf3682d20af3b5f967eafb52ecf6589fae71446734ff487e63e5157834993f1ad05636204dea70c629601765e356d90e2e25afc9e3141b42ac89

    Score
    7/10
    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Tasks