General

  • Target

    f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60

  • Size

    4.4MB

  • Sample

    221124-vjc3rage34

  • MD5

    4502245e0b02ae96258226d99721d23c

  • SHA1

    83d8858cfbf232acd0debfed4892623a996610db

  • SHA256

    f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60

  • SHA512

    3003fce276eb5a7e717923e1874d9aaac884f4235cddb87bfa4b8fd8565f9a85aac04d51961e52a97c2a7bc7029e2dca28fb3b29fd479dcdddc95ba4596be785

  • SSDEEP

    98304:PWs4acUedFHuI/jHlahs/cD7HjaeffUSG7TPU:r53eNjHla5aeff/G7L

Malware Config

Targets

    • Target

      f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60

    • Size

      4.4MB

    • MD5

      4502245e0b02ae96258226d99721d23c

    • SHA1

      83d8858cfbf232acd0debfed4892623a996610db

    • SHA256

      f3cead31bdf55bbb18a14719c925ddc380e59c8fc76093a496521469c18fdf60

    • SHA512

      3003fce276eb5a7e717923e1874d9aaac884f4235cddb87bfa4b8fd8565f9a85aac04d51961e52a97c2a7bc7029e2dca28fb3b29fd479dcdddc95ba4596be785

    • SSDEEP

      98304:PWs4acUedFHuI/jHlahs/cD7HjaeffUSG7TPU:r53eNjHla5aeff/G7L

    • Registers COM server for autorun

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks