General

  • Target

    b3a8d1e94fc123dba176c5554dcab8c25c634c2ce8028e401535c20ddfa68def

  • Size

    706KB

  • Sample

    230422-bdxqesbd42

  • MD5

    7d5e7b421aad7628049247c7a0364732

  • SHA1

    bc2a03ba1bfe7472aaf956ec01a5c52e31556423

  • SHA256

    b3a8d1e94fc123dba176c5554dcab8c25c634c2ce8028e401535c20ddfa68def

  • SHA512

    a8461725d416baf53828894ab27a0de99de52d3b5a44f1067434f4746a56847e9ef102ddf89b644cfc8a66b6aaa317d3f29e075397dfd743d449ea0079127f57

  • SSDEEP

    12288:Yy90/YFegHDhG6JrsxQSJH7YyHLccttQtkSqa/TRgrwiURODEz4e/01QrW:YyEg/Jr6/R7b4VNrEURU4zs1KW

Malware Config

Targets

    • Target

      b3a8d1e94fc123dba176c5554dcab8c25c634c2ce8028e401535c20ddfa68def

    • Size

      706KB

    • MD5

      7d5e7b421aad7628049247c7a0364732

    • SHA1

      bc2a03ba1bfe7472aaf956ec01a5c52e31556423

    • SHA256

      b3a8d1e94fc123dba176c5554dcab8c25c634c2ce8028e401535c20ddfa68def

    • SHA512

      a8461725d416baf53828894ab27a0de99de52d3b5a44f1067434f4746a56847e9ef102ddf89b644cfc8a66b6aaa317d3f29e075397dfd743d449ea0079127f57

    • SSDEEP

      12288:Yy90/YFegHDhG6JrsxQSJH7YyHLccttQtkSqa/TRgrwiURODEz4e/01QrW:YyEg/Jr6/R7b4VNrEURU4zs1KW

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks