General

  • Target

    a3561e0bd5f703737c27ee3fd9fa4d74c600e324453a57bf4279153d927bb4e8

  • Size

    964KB

  • Sample

    230419-vt32xseb4x

  • MD5

    ec11ff5f76a7afa1e8fcc088c6d7f1a3

  • SHA1

    9ffd432afc9143fd532d5008eaba19841249c7f5

  • SHA256

    a3561e0bd5f703737c27ee3fd9fa4d74c600e324453a57bf4279153d927bb4e8

  • SHA512

    4e115f95af7b75dfe9587c9f9777bd051fa6c3e4a5c0bb3f1156c10002ab4630e8a62b8f62598ff42084eec88ab3c46e5bb1ec72a77ff80bcc07846d56393007

  • SSDEEP

    24576:eyYow0KusCBzr5lRRAkDzN2nfyJ+m8CD:tYow0Kusmz5RAkDzN2nfyImx

Malware Config

Targets

    • Target

      a3561e0bd5f703737c27ee3fd9fa4d74c600e324453a57bf4279153d927bb4e8

    • Size

      964KB

    • MD5

      ec11ff5f76a7afa1e8fcc088c6d7f1a3

    • SHA1

      9ffd432afc9143fd532d5008eaba19841249c7f5

    • SHA256

      a3561e0bd5f703737c27ee3fd9fa4d74c600e324453a57bf4279153d927bb4e8

    • SHA512

      4e115f95af7b75dfe9587c9f9777bd051fa6c3e4a5c0bb3f1156c10002ab4630e8a62b8f62598ff42084eec88ab3c46e5bb1ec72a77ff80bcc07846d56393007

    • SSDEEP

      24576:eyYow0KusCBzr5lRRAkDzN2nfyJ+m8CD:tYow0Kusmz5RAkDzN2nfyImx

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks