Resubmissions

06/04/2023, 23:10

230406-25nvpsfe94 10

29/03/2021, 07:09

210329-vdnz2kc2z6 8

General

  • Target

    4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2

  • Size

    2.8MB

  • Sample

    210329-vdnz2kc2z6

  • MD5

    a282da0cf8b4a35a1fec2a5751682acf

  • SHA1

    0d56c63f4afd00d7bd67fe561a2b7de0a08ff365

  • SHA256

    4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2

  • SHA512

    c62e12270451702b4deeece6a33ef218e1d909d2c99946d45653428edfdae72f9ff20bd05bc2839fb0068abe9217ab469cc12fea748b00a7b666848003390743

Malware Config

Targets

    • Target

      4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2

    • Size

      2.8MB

    • MD5

      a282da0cf8b4a35a1fec2a5751682acf

    • SHA1

      0d56c63f4afd00d7bd67fe561a2b7de0a08ff365

    • SHA256

      4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2

    • SHA512

      c62e12270451702b4deeece6a33ef218e1d909d2c99946d45653428edfdae72f9ff20bd05bc2839fb0068abe9217ab469cc12fea748b00a7b666848003390743

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks