General

  • Target

    128c3e936515cf590f4f0abe0b198e0b01ef14a0fbfa08bc39d10a3f67782caf

  • Size

    1.1MB

  • Sample

    230420-l7fzwabb3v

  • MD5

    d98d74173c49ea7198cd649cd53a8e8e

  • SHA1

    65902a09eef21cb48732e7e712f23f9d7b53a3e2

  • SHA256

    128c3e936515cf590f4f0abe0b198e0b01ef14a0fbfa08bc39d10a3f67782caf

  • SHA512

    afd21090b516121b8ce329b11722ba56b2761a20f2d9c0b34d8a0291a6ceafe76e5cebaf6e1110af805d20b7daf7402680cee1916d17c8e4e5de92edd09eaea4

  • SSDEEP

    24576:gyYdoPpEvH7znYMP3OT+q8Pgt5YKj1ml2T9AzMv3:n307zYu+iq8PgrjR

Malware Config

Targets

    • Target

      128c3e936515cf590f4f0abe0b198e0b01ef14a0fbfa08bc39d10a3f67782caf

    • Size

      1.1MB

    • MD5

      d98d74173c49ea7198cd649cd53a8e8e

    • SHA1

      65902a09eef21cb48732e7e712f23f9d7b53a3e2

    • SHA256

      128c3e936515cf590f4f0abe0b198e0b01ef14a0fbfa08bc39d10a3f67782caf

    • SHA512

      afd21090b516121b8ce329b11722ba56b2761a20f2d9c0b34d8a0291a6ceafe76e5cebaf6e1110af805d20b7daf7402680cee1916d17c8e4e5de92edd09eaea4

    • SSDEEP

      24576:gyYdoPpEvH7znYMP3OT+q8Pgt5YKj1ml2T9AzMv3:n307zYu+iq8PgrjR

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks