General

  • Target

    virus.exe

  • Size

    2.0MB

  • Sample

    230415-xlzqmsgg3z

  • MD5

    0a373d3b74ce37de4e3cf37fe5281810

  • SHA1

    6e8fe0c19ed421b2dcb0c0c6c1f829e805f9f752

  • SHA256

    1c51cb7ecc1b372222fb3beec1de87d96d867dba48c5dbf6120aed0f15cf29b6

  • SHA512

    31e80522147557db013f342f69c35ac7294da4d0523fde7d8e7a9b4f1742a809c828d2b3b155908e98b9cf6b00ead2cb22dfc44dde80292791f908baa63ebb8a

  • SSDEEP

    49152:YF1JTaHxE87vxpsrFpIvvFqfcXkhIgs3HwCylpsEYpjERUc:Y3JTKPN+TIvYfJIv3H/ylpwKC

Malware Config

Targets

    • Target

      virus.exe

    • Size

      2.0MB

    • MD5

      0a373d3b74ce37de4e3cf37fe5281810

    • SHA1

      6e8fe0c19ed421b2dcb0c0c6c1f829e805f9f752

    • SHA256

      1c51cb7ecc1b372222fb3beec1de87d96d867dba48c5dbf6120aed0f15cf29b6

    • SHA512

      31e80522147557db013f342f69c35ac7294da4d0523fde7d8e7a9b4f1742a809c828d2b3b155908e98b9cf6b00ead2cb22dfc44dde80292791f908baa63ebb8a

    • SSDEEP

      49152:YF1JTaHxE87vxpsrFpIvvFqfcXkhIgs3HwCylpsEYpjERUc:Y3JTKPN+TIvYfJIv3H/ylpwKC

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks