General

  • Target

    f3a94dcdfe99ecbe3b07ad45a24581852ea6c47e503aa3b5fd9f4148e47fd4e6

  • Size

    694KB

  • Sample

    230421-2df1saad57

  • MD5

    bc9a30b6186b9a3c1481a8ff96507be7

  • SHA1

    7247fa2352ec1e285c355cd9fcf0296cda8344d0

  • SHA256

    f3a94dcdfe99ecbe3b07ad45a24581852ea6c47e503aa3b5fd9f4148e47fd4e6

  • SHA512

    2f8c7bed09f39b5da5f3849b0dbe812d560ad891fb4bbf175865d74cade5560246639d1144cdc655362201130bcff08799ac53cfa5803cebf6dac8a11d17f302

  • SSDEEP

    12288:Xy90StO6rmPgTPWk1LmsWQhGowyy+DUZjiPaydT7Do7aGxPBlHANUudt:XyDmPg7J1DWBzyy+QViPa0UTB3R8t

Malware Config

Targets

    • Target

      f3a94dcdfe99ecbe3b07ad45a24581852ea6c47e503aa3b5fd9f4148e47fd4e6

    • Size

      694KB

    • MD5

      bc9a30b6186b9a3c1481a8ff96507be7

    • SHA1

      7247fa2352ec1e285c355cd9fcf0296cda8344d0

    • SHA256

      f3a94dcdfe99ecbe3b07ad45a24581852ea6c47e503aa3b5fd9f4148e47fd4e6

    • SHA512

      2f8c7bed09f39b5da5f3849b0dbe812d560ad891fb4bbf175865d74cade5560246639d1144cdc655362201130bcff08799ac53cfa5803cebf6dac8a11d17f302

    • SSDEEP

      12288:Xy90StO6rmPgTPWk1LmsWQhGowyy+DUZjiPaydT7Do7aGxPBlHANUudt:XyDmPg7J1DWBzyy+QViPa0UTB3R8t

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks