General

  • Target

    ea9f0760a85eaf8c80e137cdac113a7a9a5a69108ac4d0d3dce801402b64b40b

  • Size

    706KB

  • Sample

    230422-cqlz5adf8x

  • MD5

    97a6a2c76e63982557bbd1ef54f0512d

  • SHA1

    0dcc9bf8c1708e2ed92160450f0ed12e9cbdd98a

  • SHA256

    ea9f0760a85eaf8c80e137cdac113a7a9a5a69108ac4d0d3dce801402b64b40b

  • SHA512

    a99882b19cb8944de10ecd6856415c6c8f0345de6b87aee2d8b83ef276da679e8e5436231fac0165d06d4152b974ecd4b8d80396fe0b0d4e753c4157e94b74e4

  • SSDEEP

    12288:Ky90W9+jA1m5u1CvywUpxQAhniQWxl6BA/KgrsiUjODI+J91d4t:KydGA1m40K7rpouAtUjUlJ9U

Malware Config

Targets

    • Target

      ea9f0760a85eaf8c80e137cdac113a7a9a5a69108ac4d0d3dce801402b64b40b

    • Size

      706KB

    • MD5

      97a6a2c76e63982557bbd1ef54f0512d

    • SHA1

      0dcc9bf8c1708e2ed92160450f0ed12e9cbdd98a

    • SHA256

      ea9f0760a85eaf8c80e137cdac113a7a9a5a69108ac4d0d3dce801402b64b40b

    • SHA512

      a99882b19cb8944de10ecd6856415c6c8f0345de6b87aee2d8b83ef276da679e8e5436231fac0165d06d4152b974ecd4b8d80396fe0b0d4e753c4157e94b74e4

    • SSDEEP

      12288:Ky90W9+jA1m5u1CvywUpxQAhniQWxl6BA/KgrsiUjODI+J91d4t:KydGA1m40K7rpouAtUjUlJ9U

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks