General

  • Target

    meiryo_console.ttf

  • Size

    89KB

  • Sample

    220806-jrkl1sccfl

  • MD5

    a9d4f514a5a8282eb1d4dc200c8dd03a

  • SHA1

    db6dadf3c895408c2b8c2ed85afbc856dc48cbbe

  • SHA256

    fca993f29156bb9047377ffd50cf5f1aee59480904511d5269a8adbed6ce0297

  • SHA512

    d5731aecfb39eed04c908a3e9dc80ce1048615eed56e6cd027cd18f492f5c6003dc824518628539ddd0e9095123cea7fe05d0523f5845adaab2b401cbbf67ad5

Malware Config

Targets

    • Target

      meiryo_console.ttf

    • Size

      89KB

    • MD5

      a9d4f514a5a8282eb1d4dc200c8dd03a

    • SHA1

      db6dadf3c895408c2b8c2ed85afbc856dc48cbbe

    • SHA256

      fca993f29156bb9047377ffd50cf5f1aee59480904511d5269a8adbed6ce0297

    • SHA512

      d5731aecfb39eed04c908a3e9dc80ce1048615eed56e6cd027cd18f492f5c6003dc824518628539ddd0e9095123cea7fe05d0523f5845adaab2b401cbbf67ad5

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks