General

  • Target

    f04004c72855e8eb557e398f40694b1e15be4aadde32e1138a98e10e7866320f

  • Size

    569KB

  • Sample

    230422-fzqlfsch33

  • MD5

    ee4862e83b39453d02b947032eb21dc6

  • SHA1

    d520c5cfce7d4f874fadeb1fe95d5b434110fcfa

  • SHA256

    f04004c72855e8eb557e398f40694b1e15be4aadde32e1138a98e10e7866320f

  • SHA512

    37ee818d8da214c81eb46ee483d1c2ed0c160bed8fd62920b45c54cfd6c430c5c659f68cb17848e7a7b75c4a784a2cefbdfc3a7c9f8de36c1ac3fb8a82d1a006

  • SSDEEP

    12288:cy903CA6S4/TMC+iQVU+UaF5d/nLY8L0LTlDA0DL17hPZ:cyEGx/oCqKDax/nNLYBPtBZ

Malware Config

Targets

    • Target

      f04004c72855e8eb557e398f40694b1e15be4aadde32e1138a98e10e7866320f

    • Size

      569KB

    • MD5

      ee4862e83b39453d02b947032eb21dc6

    • SHA1

      d520c5cfce7d4f874fadeb1fe95d5b434110fcfa

    • SHA256

      f04004c72855e8eb557e398f40694b1e15be4aadde32e1138a98e10e7866320f

    • SHA512

      37ee818d8da214c81eb46ee483d1c2ed0c160bed8fd62920b45c54cfd6c430c5c659f68cb17848e7a7b75c4a784a2cefbdfc3a7c9f8de36c1ac3fb8a82d1a006

    • SSDEEP

      12288:cy903CA6S4/TMC+iQVU+UaF5d/nLY8L0LTlDA0DL17hPZ:cyEGx/oCqKDax/nNLYBPtBZ

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks