General

  • Target

    ChromaCam-3.2.2.0.exe

  • Size

    254.7MB

  • Sample

    220414-scyprsgda5

  • MD5

    1c28a7ed19329ce735831e62fe834689

  • SHA1

    e3a7bfffddb451ed10db09d9a2cba84e2cc788ba

  • SHA256

    769807d48dcdeeecf42a024db940a90ac879bc10e9e5864d29fb339e3358d9e6

  • SHA512

    9eded222432abaa7faf334fdf69c4217cae3cb25733bc26f5925257cc1a61e2f3d7318f8dc17c43dda3129dd082736836cb1f3e6a443c2631891f1b2aea60dbb

Malware Config

Targets

    • Target

      ChromaCam-3.2.2.0.exe

    • Size

      254.7MB

    • MD5

      1c28a7ed19329ce735831e62fe834689

    • SHA1

      e3a7bfffddb451ed10db09d9a2cba84e2cc788ba

    • SHA256

      769807d48dcdeeecf42a024db940a90ac879bc10e9e5864d29fb339e3358d9e6

    • SHA512

      9eded222432abaa7faf334fdf69c4217cae3cb25733bc26f5925257cc1a61e2f3d7318f8dc17c43dda3129dd082736836cb1f3e6a443c2631891f1b2aea60dbb

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • Registers COM server for autorun

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file execution options in registry

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks