General

  • Target

    52b2c343f02d28d61e4a0c942f22ac4eb72eb923fbb7ff9b95b1e382758007cc

  • Size

    559KB

  • Sample

    230422-1axcxsgg97

  • MD5

    c1ad052a7780753a43d186afeaa71556

  • SHA1

    40a2b79b11476e0dea6a4903f843af956c91bac4

  • SHA256

    52b2c343f02d28d61e4a0c942f22ac4eb72eb923fbb7ff9b95b1e382758007cc

  • SHA512

    27aafda5d96a0a8fad8a33681ecc2d0d1496436aed16b9e845513996a9e9e55669173e0d495b3550da38872e6b7af3e875baa63dd478436480133003fe89e5e5

  • SSDEEP

    12288:my90BTS3wYFvDJomusvCAc+6uqeEc7/6BhanFNdu:myyTswwzu8MuqjAc

Malware Config

Targets

    • Target

      52b2c343f02d28d61e4a0c942f22ac4eb72eb923fbb7ff9b95b1e382758007cc

    • Size

      559KB

    • MD5

      c1ad052a7780753a43d186afeaa71556

    • SHA1

      40a2b79b11476e0dea6a4903f843af956c91bac4

    • SHA256

      52b2c343f02d28d61e4a0c942f22ac4eb72eb923fbb7ff9b95b1e382758007cc

    • SHA512

      27aafda5d96a0a8fad8a33681ecc2d0d1496436aed16b9e845513996a9e9e55669173e0d495b3550da38872e6b7af3e875baa63dd478436480133003fe89e5e5

    • SSDEEP

      12288:my90BTS3wYFvDJomusvCAc+6uqeEc7/6BhanFNdu:myyTswwzu8MuqjAc

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks