General

  • Target

    35e6962728f976ee21cc9cc970448972aee0af1cce153240f423a5191721dcb3

  • Size

    558KB

  • Sample

    230421-z9npdsbh5s

  • MD5

    74f5c9bb1922b806775a7ef32e0fafcd

  • SHA1

    df5075a9d0f267ca511b1477f4d2a4a4915d5106

  • SHA256

    35e6962728f976ee21cc9cc970448972aee0af1cce153240f423a5191721dcb3

  • SHA512

    fce52973758fffb2a21e92f8726fc14004ee944e6f22a469387574943ec2c8dc4af050c3d1a21712173d30fd2fc3674aed41fd7632b5703a6efcc9efc3bd5ddc

  • SSDEEP

    12288:wy9052PZ3/9pHOA/e8raEioEDnNaixPBq2oC7S:wyo21/97R2zHN02oqS

Malware Config

Targets

    • Target

      35e6962728f976ee21cc9cc970448972aee0af1cce153240f423a5191721dcb3

    • Size

      558KB

    • MD5

      74f5c9bb1922b806775a7ef32e0fafcd

    • SHA1

      df5075a9d0f267ca511b1477f4d2a4a4915d5106

    • SHA256

      35e6962728f976ee21cc9cc970448972aee0af1cce153240f423a5191721dcb3

    • SHA512

      fce52973758fffb2a21e92f8726fc14004ee944e6f22a469387574943ec2c8dc4af050c3d1a21712173d30fd2fc3674aed41fd7632b5703a6efcc9efc3bd5ddc

    • SSDEEP

      12288:wy9052PZ3/9pHOA/e8raEioEDnNaixPBq2oC7S:wyo21/97R2zHN02oqS

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks