General

  • Target

    f63de0de3475c68e4ddccbc827a42721d3fb4f6d711bc3cbfd7510c81ec440de

  • Size

    966KB

  • Sample

    230422-k4lwaaea45

  • MD5

    caf2cfc193be9fe3be5569e44829792d

  • SHA1

    870d45acb3cb9c03d5e8f305a7bd775537576cbb

  • SHA256

    f63de0de3475c68e4ddccbc827a42721d3fb4f6d711bc3cbfd7510c81ec440de

  • SHA512

    6e26826c2ba76af32ad646d680cb0c5ecf84c6dbdee7f6802e22e30cc1e1e4aa96dd938fa3845e0332eddbab31c3767b8d97d085b8ea5420c7da278933de2c11

  • SSDEEP

    24576:NyRqAEMwL5HWP28asiZnTgYT+uTCqnrwOrq:oNgHW+8PiZnT3pTC2Mi

Malware Config

Targets

    • Target

      f63de0de3475c68e4ddccbc827a42721d3fb4f6d711bc3cbfd7510c81ec440de

    • Size

      966KB

    • MD5

      caf2cfc193be9fe3be5569e44829792d

    • SHA1

      870d45acb3cb9c03d5e8f305a7bd775537576cbb

    • SHA256

      f63de0de3475c68e4ddccbc827a42721d3fb4f6d711bc3cbfd7510c81ec440de

    • SHA512

      6e26826c2ba76af32ad646d680cb0c5ecf84c6dbdee7f6802e22e30cc1e1e4aa96dd938fa3845e0332eddbab31c3767b8d97d085b8ea5420c7da278933de2c11

    • SSDEEP

      24576:NyRqAEMwL5HWP28asiZnTgYT+uTCqnrwOrq:oNgHW+8PiZnT3pTC2Mi

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks