General

  • Target

    289d1cf294220764917b844e935d20f1430f1bc7ddee8b9e271e6f42164106ce

  • Size

    48KB

  • Sample

    221123-m8yrrabc7s

  • MD5

    3c1c0458478a37f6e2d6bc55539b35df

  • SHA1

    9937a456bc7d3f84200e20525cea3ad3a857f391

  • SHA256

    289d1cf294220764917b844e935d20f1430f1bc7ddee8b9e271e6f42164106ce

  • SHA512

    2f4eaf7400e35886686e667420b188b59e340e49e8f656d6ae2a87650436f949247856a62fbc4cff6f58ecdbb369a263e962b03b679612772174c184e24cf8b7

  • SSDEEP

    768:vrB9zajzcpbFoS9VcjDpqGcILdeBQL15J1NZIMOAyLoouJK8lxBLr1:vrB9zauFouWj9J5eBQL15J1NZ/OaJKk1

Malware Config

Targets

    • Target

      289d1cf294220764917b844e935d20f1430f1bc7ddee8b9e271e6f42164106ce

    • Size

      48KB

    • MD5

      3c1c0458478a37f6e2d6bc55539b35df

    • SHA1

      9937a456bc7d3f84200e20525cea3ad3a857f391

    • SHA256

      289d1cf294220764917b844e935d20f1430f1bc7ddee8b9e271e6f42164106ce

    • SHA512

      2f4eaf7400e35886686e667420b188b59e340e49e8f656d6ae2a87650436f949247856a62fbc4cff6f58ecdbb369a263e962b03b679612772174c184e24cf8b7

    • SSDEEP

      768:vrB9zajzcpbFoS9VcjDpqGcILdeBQL15J1NZIMOAyLoouJK8lxBLr1:vrB9zauFouWj9J5eBQL15J1NZ/OaJKk1

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks