General

  • Target

    9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

  • Size

    558KB

  • Sample

    230421-3sz8mscg6z

  • MD5

    32e00fcd2f4c23f61c42158875acdf03

  • SHA1

    0d14ab6c6cda79265a3a6a7ea755134efe4489b0

  • SHA256

    9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

  • SHA512

    e397c430c97cee3c1abd8f12fc2cbeb9f788a935270d2880d18180e716e5e360a87de8354ec4ee9e3f1af9608c3c683267c96afc809a709a7f89812f34b0b4dd

  • SSDEEP

    12288:sy90lJXIwctgAy2N1fB24oKpcCYMQj1R/k:syiJYzgi1p9oKpJYMou

Malware Config

Targets

    • Target

      9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

    • Size

      558KB

    • MD5

      32e00fcd2f4c23f61c42158875acdf03

    • SHA1

      0d14ab6c6cda79265a3a6a7ea755134efe4489b0

    • SHA256

      9966779fec0beba2f8e5ec1b433403d16da0fbeb7202c14fd26d071f31277ad5

    • SHA512

      e397c430c97cee3c1abd8f12fc2cbeb9f788a935270d2880d18180e716e5e360a87de8354ec4ee9e3f1af9608c3c683267c96afc809a709a7f89812f34b0b4dd

    • SSDEEP

      12288:sy90lJXIwctgAy2N1fB24oKpcCYMQj1R/k:syiJYzgi1p9oKpJYMou

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks