General

  • Target

    d08bfe369b715b7a3c22e883edde12a57bce69344f1f61460eec0645c7a226b3

  • Size

    966KB

  • Sample

    230419-2xrlmadh35

  • MD5

    634cb513c1d44c510ab88cd8db9c5595

  • SHA1

    413a72ab0c3c22bdf807fe2b230ec30ea828c5d3

  • SHA256

    d08bfe369b715b7a3c22e883edde12a57bce69344f1f61460eec0645c7a226b3

  • SHA512

    af17f33d8d769336cea75f22640f7e0d7d257e98be3f632d3289880e92f5551aef9fcc1b0c6c7fad18514cea37bf56a3e73b66b859723ad3817c9fb6fa2a13a9

  • SSDEEP

    24576:jyzaVFShrd3nZhSg5Z3ThQrbAygDfAWbGjfnP:2zc8l7ThQrbkbGjv

Malware Config

Targets

    • Target

      d08bfe369b715b7a3c22e883edde12a57bce69344f1f61460eec0645c7a226b3

    • Size

      966KB

    • MD5

      634cb513c1d44c510ab88cd8db9c5595

    • SHA1

      413a72ab0c3c22bdf807fe2b230ec30ea828c5d3

    • SHA256

      d08bfe369b715b7a3c22e883edde12a57bce69344f1f61460eec0645c7a226b3

    • SHA512

      af17f33d8d769336cea75f22640f7e0d7d257e98be3f632d3289880e92f5551aef9fcc1b0c6c7fad18514cea37bf56a3e73b66b859723ad3817c9fb6fa2a13a9

    • SSDEEP

      24576:jyzaVFShrd3nZhSg5Z3ThQrbAygDfAWbGjfnP:2zc8l7ThQrbkbGjv

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks