General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.4812.7339

  • Size

    477KB

  • Sample

    210722-cj4ptxl1q6

  • MD5

    6a6bcfa2451c8a2eb94d79150c4c23a4

  • SHA1

    4d136a12af7666fde086b58c978925b14e83f5af

  • SHA256

    9a89d59fd9fc97f37e19fd750bff125617632780fe9061aebd5988037e0101ba

  • SHA512

    192443676e6d06797d5880f3a0f42b98d67b4c48281a5b70e7eba1513b2165da2c4cf1dc0f69b530219b8b93b11ddbf4b716a6aeb8bb3f56fd686dd92a667537

Malware Config

Targets

    • Target

      SecuriteInfo.com.W32.AIDetect.malware1.4812.7339

    • Size

      477KB

    • MD5

      6a6bcfa2451c8a2eb94d79150c4c23a4

    • SHA1

      4d136a12af7666fde086b58c978925b14e83f5af

    • SHA256

      9a89d59fd9fc97f37e19fd750bff125617632780fe9061aebd5988037e0101ba

    • SHA512

      192443676e6d06797d5880f3a0f42b98d67b4c48281a5b70e7eba1513b2165da2c4cf1dc0f69b530219b8b93b11ddbf4b716a6aeb8bb3f56fd686dd92a667537

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks