General

  • Target

    8866811dd8d9383cf6c5db218e2f6aa364a4c3f077423152483cbcc8696c3ffe

  • Size

    325KB

  • Sample

    210726-kk2qhb8r36

  • MD5

    8e243f0d912015e58b3a8e936ba9f2be

  • SHA1

    91edd256caa08d5a641ef78684720427a77c6e78

  • SHA256

    8866811dd8d9383cf6c5db218e2f6aa364a4c3f077423152483cbcc8696c3ffe

  • SHA512

    c845d94b2b2a4e90970165438870c5da842dc94ef59e24e80377eff5d3593bb5cab3e1f2c549883965940aa49a91aa0519fb33c3116112e05b6751d0e2f8ec36

Malware Config

Targets

    • Target

      8866811dd8d9383cf6c5db218e2f6aa364a4c3f077423152483cbcc8696c3ffe

    • Size

      325KB

    • MD5

      8e243f0d912015e58b3a8e936ba9f2be

    • SHA1

      91edd256caa08d5a641ef78684720427a77c6e78

    • SHA256

      8866811dd8d9383cf6c5db218e2f6aa364a4c3f077423152483cbcc8696c3ffe

    • SHA512

      c845d94b2b2a4e90970165438870c5da842dc94ef59e24e80377eff5d3593bb5cab3e1f2c549883965940aa49a91aa0519fb33c3116112e05b6751d0e2f8ec36

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks