dbafc9f7c6cbf8ec5b7ed0abfd9221ada079a8f3afd846f15fd508c70e76790b

General

Target

dbafc9f7c6cbf8ec5b7ed0abfd9221ada079a8f3afd846f15fd508c70e76790b
Size

2.6MB
Sample

240629-d876ratbrm
MD5

a7b2c90064b4c12a09c6a18b7285ff1f
SHA1

562c61ece5dd467b2014c291a68bd8b414524215
SHA256

dbafc9f7c6cbf8ec5b7ed0abfd9221ada079a8f3afd846f15fd508c70e76790b
SHA512

2b236fb426a7acb4b80a6e243854ce045d3ca56692182c1bec71481429e9d6ba2c57ebc81ba179b90fbdac9ae8179efa2831c55fed252db32b825b6dbe1f5873
SSDEEP

24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eJ:ObCjPKNqQEfsw43qtmVfq4s

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.mail.me.com
Port:
587
Username:
[email protected]
Password:
RICHARD205lord

Targets

- Target
  
  dbafc9f7c6cbf8ec5b7ed0abfd9221ada079a8f3afd846f15fd508c70e76790b
- Size
  
  2.6MB
- MD5
  
  a7b2c90064b4c12a09c6a18b7285ff1f
- SHA1
  
  562c61ece5dd467b2014c291a68bd8b414524215
- SHA256
  
  dbafc9f7c6cbf8ec5b7ed0abfd9221ada079a8f3afd846f15fd508c70e76790b
- SHA512
  
  2b236fb426a7acb4b80a6e243854ce045d3ca56692182c1bec71481429e9d6ba2c57ebc81ba179b90fbdac9ae8179efa2831c55fed252db32b825b6dbe1f5873
- SSDEEP
  
  24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4eJ:ObCjPKNqQEfsw43qtmVfq4s
Score

10^/10

collection discovery persistence spyware stealer upx
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables packed with MEW
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables packed with MEW

Detects executables referencing many email and collaboration clients. Observed in information stealers

UPX dump on OEP (original entry point)

Executes dropped EXE

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

UPX packed file

Accesses Microsoft Outlook accounts

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2