General

  • Target

    8f8013947ab178588588fe7505cdea3514b2c7494a3cd6e0b61717b5395699cd

  • Size

    1.8MB

  • Sample

    221123-qy6ldsac5v

  • MD5

    2d0545afe968c261aabb2bc60eed6f99

  • SHA1

    45a7fc5a434c2bce192c42d4f1861ffdcf04bfad

  • SHA256

    8f8013947ab178588588fe7505cdea3514b2c7494a3cd6e0b61717b5395699cd

  • SHA512

    10638a7aaa071c44b556242fba82f95eb1b005a9cc41ff2f168a0357b5e1b95f61de13bafa4fb3f8ae98e2c0ebf72b41097a007bd202a56d0020d5a06fb891d6

  • SSDEEP

    49152:tkiXmqBxMJ2i14eBT+BBrCYIFeC5jEwSsQs54uEe:W4txMJ714eh+b2Fpu+QCUe

Malware Config

Targets

    • Target

      8f8013947ab178588588fe7505cdea3514b2c7494a3cd6e0b61717b5395699cd

    • Size

      1.8MB

    • MD5

      2d0545afe968c261aabb2bc60eed6f99

    • SHA1

      45a7fc5a434c2bce192c42d4f1861ffdcf04bfad

    • SHA256

      8f8013947ab178588588fe7505cdea3514b2c7494a3cd6e0b61717b5395699cd

    • SHA512

      10638a7aaa071c44b556242fba82f95eb1b005a9cc41ff2f168a0357b5e1b95f61de13bafa4fb3f8ae98e2c0ebf72b41097a007bd202a56d0020d5a06fb891d6

    • SSDEEP

      49152:tkiXmqBxMJ2i14eBT+BBrCYIFeC5jEwSsQs54uEe:W4txMJ714eh+b2Fpu+QCUe

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks