General

  • Target

    tmp

  • Size

    83KB

  • Sample

    230420-wgvqfsdd6z

  • MD5

    d6b513b2be6b5daf42989747a6e17543

  • SHA1

    03557846f02bea7e1d1181b4372d987e61e99329

  • SHA256

    bfed711753334aed91c90fd445c73638be1772ae490b504375a24ea4b9ad3dfa

  • SHA512

    934bcde7272ba1557b0b2a38655ee791e924018b4bcf163eeb6a81cb21346aa79fdfdf0f0c26b8830e1cd1bd40e8891004c177bb0f26e2703e461cd71c202c81

  • SSDEEP

    768:bIdmENpxH6aRpqgEJBDitZRIZK2Y4MrtJ1siBJ8VeBjIjsIpBTSibA1oJeLnbKwx:bIdVVFPISwiNjKLB1bA1uezm16g6tY/

Malware Config

Targets

    • Target

      tmp

    • Size

      83KB

    • MD5

      d6b513b2be6b5daf42989747a6e17543

    • SHA1

      03557846f02bea7e1d1181b4372d987e61e99329

    • SHA256

      bfed711753334aed91c90fd445c73638be1772ae490b504375a24ea4b9ad3dfa

    • SHA512

      934bcde7272ba1557b0b2a38655ee791e924018b4bcf163eeb6a81cb21346aa79fdfdf0f0c26b8830e1cd1bd40e8891004c177bb0f26e2703e461cd71c202c81

    • SSDEEP

      768:bIdmENpxH6aRpqgEJBDitZRIZK2Y4MrtJ1siBJ8VeBjIjsIpBTSibA1oJeLnbKwx:bIdVVFPISwiNjKLB1bA1uezm16g6tY/

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks