General

  • Target

    mixazed_20210727-134206

  • Size

    586KB

  • Sample

    210727-aydqfma51s

  • MD5

    f41543a644518a10310dc1ad0f426a2f

  • SHA1

    ff264d3050f0ba4b051297436d179f8ae085f0dd

  • SHA256

    4cadd46b6ff2ab3dc1ebcf6687480e22da27c4b44902a9d13d3a0c7454b6c854

  • SHA512

    f2b95fd006cb9b77bd0c820158bf39d32f983fbffac86defa662c5430e3db8c789aa69a7593aa9a26c9737066e8b55a550b83f66231d5b816c7523e4bf67194e

Malware Config

Targets

    • Target

      mixazed_20210727-134206

    • Size

      586KB

    • MD5

      f41543a644518a10310dc1ad0f426a2f

    • SHA1

      ff264d3050f0ba4b051297436d179f8ae085f0dd

    • SHA256

      4cadd46b6ff2ab3dc1ebcf6687480e22da27c4b44902a9d13d3a0c7454b6c854

    • SHA512

      f2b95fd006cb9b77bd0c820158bf39d32f983fbffac86defa662c5430e3db8c789aa69a7593aa9a26c9737066e8b55a550b83f66231d5b816c7523e4bf67194e

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks