General

  • Target

    253dc675eceaf5e241df64306d0de350af4715a0

  • Size

    843KB

  • Sample

    230111-qjw4eacg53

  • MD5

    e2e8e1d58b06d7e05bef8c13bca92ab3

  • SHA1

    253dc675eceaf5e241df64306d0de350af4715a0

  • SHA256

    6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f

  • SHA512

    227b165ff0318d71416b5125bb7ff3b5e5c0099d558563f980a9c0d9d136a21f59794a0d47522e845fb92eefaf71a62dbd3f2568a3636d4096533bfee3bbe05a

  • SSDEEP

    24576:Dgh/1s5nyyx+NxEyafsab6JJH6UgLlrNsuru:ch/1s5nyC+NqyafsaGJJH6zBrNb

Malware Config

Targets

    • Target

      253dc675eceaf5e241df64306d0de350af4715a0

    • Size

      843KB

    • MD5

      e2e8e1d58b06d7e05bef8c13bca92ab3

    • SHA1

      253dc675eceaf5e241df64306d0de350af4715a0

    • SHA256

      6532e16d04ebfc98395b0e06fb2c1210d5064dc242c2c374beccb6b561a58f6f

    • SHA512

      227b165ff0318d71416b5125bb7ff3b5e5c0099d558563f980a9c0d9d136a21f59794a0d47522e845fb92eefaf71a62dbd3f2568a3636d4096533bfee3bbe05a

    • SSDEEP

      24576:Dgh/1s5nyyx+NxEyafsab6JJH6UgLlrNsuru:ch/1s5nyC+NqyafsaGJJH6zBrNb

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks