General

  • Target

    0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796

  • Size

    944KB

  • Sample

    220516-yvhddsaaek

  • MD5

    8f13700aaaab492434d453c885cd17a3

  • SHA1

    8ae74e13758595061e78e6be818866017104e9d8

  • SHA256

    0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796

  • SHA512

    9c7f54cb1f965aff6e28e14ff59f6f99681d2987183703c57e691eb5f44f15b35036eae8a81ec4a702934cf4b09ccfc4fe33e9b18d92a216a8d56e85c47dd0d7

Malware Config

Targets

    • Target

      0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796

    • Size

      944KB

    • MD5

      8f13700aaaab492434d453c885cd17a3

    • SHA1

      8ae74e13758595061e78e6be818866017104e9d8

    • SHA256

      0063226590deb5cdd3fa0a8da40e0888f780949c13ee339467114a6a9722b796

    • SHA512

      9c7f54cb1f965aff6e28e14ff59f6f99681d2987183703c57e691eb5f44f15b35036eae8a81ec4a702934cf4b09ccfc4fe33e9b18d92a216a8d56e85c47dd0d7

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks