General

  • Target

    ee408fa74fbfe568a05b0bbeff2e4339.msi

  • Size

    4.0MB

  • Sample

    211122-jr5l7afafl

  • MD5

    ee408fa74fbfe568a05b0bbeff2e4339

  • SHA1

    0e8e7da9769102123a1bd8ad0d22e48338d20495

  • SHA256

    abe6b696965b8e856ccb20587f8a2fc8327169557e0083cebeab58e14a9d0560

  • SHA512

    290d475b870da3d3e436d67b6aed192e1f68be592ee2b9eb70b2731596c8ce13be7c0bfd0192d63b57d4d103cca4f5a6d781ccf8dba17234f73c247de21162ac

Malware Config

Extracted

Family

latam_generic_downloader

C2

https://webchatpyxx12gt.com/O/BGT325GGHDHBDHHBFHJFFF2121.zip

Targets

    • Target

      ee408fa74fbfe568a05b0bbeff2e4339.msi

    • Size

      4.0MB

    • MD5

      ee408fa74fbfe568a05b0bbeff2e4339

    • SHA1

      0e8e7da9769102123a1bd8ad0d22e48338d20495

    • SHA256

      abe6b696965b8e856ccb20587f8a2fc8327169557e0083cebeab58e14a9d0560

    • SHA512

      290d475b870da3d3e436d67b6aed192e1f68be592ee2b9eb70b2731596c8ce13be7c0bfd0192d63b57d4d103cca4f5a6d781ccf8dba17234f73c247de21162ac

    Score
    10/10
    • suricata: ET MALWARE Ousaban Banker Checkin M1

      suricata: ET MALWARE Ousaban Banker Checkin M1

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks