General

  • Target

    setup.exe

  • Size

    74.0MB

  • Sample

    230319-cjra9see29

  • MD5

    4e09d136fa5de1d448ca1b45be6ccd74

  • SHA1

    f028d356a6b1f3cc465b51b744417265be157e2a

  • SHA256

    9b993ae2a03205f3b405268a7d18954b7ac77fb3d44544bed32d451abcc31f9a

  • SHA512

    f395999908f91eb010ef6926a12e5149273917f04bf827c7e704510d11576164dbb53c6663461802ce9645dc1c021cc6529578d098172898c38cdd067ca1f9e6

  • SSDEEP

    1572864:dh2KQ+naf15fFr6foEdW5GedVHIW98cFVuiG+J44AD5EPEEOb7S:dYmnaf11so7wevHIW9RJ4NG

Malware Config

Targets

    • Target

      setup.exe

    • Size

      74.0MB

    • MD5

      4e09d136fa5de1d448ca1b45be6ccd74

    • SHA1

      f028d356a6b1f3cc465b51b744417265be157e2a

    • SHA256

      9b993ae2a03205f3b405268a7d18954b7ac77fb3d44544bed32d451abcc31f9a

    • SHA512

      f395999908f91eb010ef6926a12e5149273917f04bf827c7e704510d11576164dbb53c6663461802ce9645dc1c021cc6529578d098172898c38cdd067ca1f9e6

    • SSDEEP

      1572864:dh2KQ+naf15fFr6foEdW5GedVHIW98cFVuiG+J44AD5EPEEOb7S:dYmnaf11so7wevHIW9RJ4NG

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Collection

Data from Local System

1
T1005

Tasks