General

  • Target

    be170778d84cdc6b65af1b75c11fb153c03109149a117fab2a911b43ffacf079

  • Size

    1.0MB

  • Sample

    230421-b1tbhsfd3z

  • MD5

    5226dc979f06bb8bc633a01b885a2a1e

  • SHA1

    99cb30a570bd5a13202650ffd62ca9eea0d4c7ab

  • SHA256

    be170778d84cdc6b65af1b75c11fb153c03109149a117fab2a911b43ffacf079

  • SHA512

    6077e24075a83e21bdf98d907d3c78672c575ef63a5675d75dee10e6888478c0b14f1d1914ee4c2327aa091107df7ef9e86136a77e57a58b2c18f35e0031d6bf

  • SSDEEP

    24576:Dy65WJEEYfQYmszH6aUV3tNPfpRUbpehbHied:W65eq1zaTV3nHMNepie

Malware Config

Targets

    • Target

      be170778d84cdc6b65af1b75c11fb153c03109149a117fab2a911b43ffacf079

    • Size

      1.0MB

    • MD5

      5226dc979f06bb8bc633a01b885a2a1e

    • SHA1

      99cb30a570bd5a13202650ffd62ca9eea0d4c7ab

    • SHA256

      be170778d84cdc6b65af1b75c11fb153c03109149a117fab2a911b43ffacf079

    • SHA512

      6077e24075a83e21bdf98d907d3c78672c575ef63a5675d75dee10e6888478c0b14f1d1914ee4c2327aa091107df7ef9e86136a77e57a58b2c18f35e0031d6bf

    • SSDEEP

      24576:Dy65WJEEYfQYmszH6aUV3tNPfpRUbpehbHied:W65eq1zaTV3nHMNepie

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks