General

  • Target

    d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d

  • Size

    656KB

  • Sample

    221003-fzmvkaagen

  • MD5

    584a78233a7a25afcff64c131e8a92f0

  • SHA1

    7f487305bc3f83f4348ba4cdb85e07ff20ee52a0

  • SHA256

    d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d

  • SHA512

    eb2d7fd65c3781dd63434152e3b0a7d99f45acce03150ea3dcf3e3dbcdd97c0c3a0fc13e2d3ebef1b23a06343acc63a8d131020410c3b9fa2e2dbcb2c50b25c6

  • SSDEEP

    12288:Zg+VMI/O4to6nVKnbGTzpq+7zkMNTMyRJgkdYLCjxbPginXynxuqKnJ:Z5Omo6VI6JpRJgkdY2jJIinXWxuqKnJ

Malware Config

Targets

    • Target

      d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d

    • Size

      656KB

    • MD5

      584a78233a7a25afcff64c131e8a92f0

    • SHA1

      7f487305bc3f83f4348ba4cdb85e07ff20ee52a0

    • SHA256

      d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d

    • SHA512

      eb2d7fd65c3781dd63434152e3b0a7d99f45acce03150ea3dcf3e3dbcdd97c0c3a0fc13e2d3ebef1b23a06343acc63a8d131020410c3b9fa2e2dbcb2c50b25c6

    • SSDEEP

      12288:Zg+VMI/O4to6nVKnbGTzpq+7zkMNTMyRJgkdYLCjxbPginXynxuqKnJ:Z5Omo6VI6JpRJgkdY2jJIinXWxuqKnJ

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks