General

  • Target

    file.exe

  • Size

    373KB

  • Sample

    220920-cdt5zafdbj

  • MD5

    5f59691b93c06b3a123a8db348493239

  • SHA1

    22c8a5ccd2a00adbac98485a080979b348bbf37c

  • SHA256

    9e6548b653ee412b729f669bad36d14d12a385176c0b83e945d9c446c90916e3

  • SHA512

    89c0e0d0a05d232b3d864722696ed3b5aa0502b4d28e2009fbd374fe7a8cd5efa5ea4df2cfdbd0fc6091e5351e17d414634e9e2a7fac48ca3807752a75766a4a

  • SSDEEP

    6144:Y9nI7jyFhXzqOOUfp+dgFV7HcpiSChP0LeYigavwVfL:Y9nI7uzXz7O+p+U0LCiLS

Malware Config

Targets

    • Target

      file.exe

    • Size

      373KB

    • MD5

      5f59691b93c06b3a123a8db348493239

    • SHA1

      22c8a5ccd2a00adbac98485a080979b348bbf37c

    • SHA256

      9e6548b653ee412b729f669bad36d14d12a385176c0b83e945d9c446c90916e3

    • SHA512

      89c0e0d0a05d232b3d864722696ed3b5aa0502b4d28e2009fbd374fe7a8cd5efa5ea4df2cfdbd0fc6091e5351e17d414634e9e2a7fac48ca3807752a75766a4a

    • SSDEEP

      6144:Y9nI7jyFhXzqOOUfp+dgFV7HcpiSChP0LeYigavwVfL:Y9nI7uzXz7O+p+U0LCiLS

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses 2FA software files, possible credential harvesting

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks