General

  • Target

    23dfe58789c140fb3020f9b97c4c6a9635e00fdff341e169e8683629dd810e42

  • Size

    707KB

  • Sample

    230422-kpcdasff4v

  • MD5

    ab74fb9069dc3151aee0e4ce6287dceb

  • SHA1

    7f4a6c04c7cfacc7a9d2d4e2d46c2e6de6d36215

  • SHA256

    23dfe58789c140fb3020f9b97c4c6a9635e00fdff341e169e8683629dd810e42

  • SHA512

    74a707eca1583cb2a5a239aea2c48f62b5826ada14344db86b9d239b72cba86600012e896767291e8e31bc3510888c19446984bf8aba469f3b859cc48d424943

  • SSDEEP

    12288:7y90h+/0Z/IAgrNzZ3oRQZbpCbu8JQT+KOzn6W/cE8kmFkgK1XH:7yM+/0Z/IP1oRgtqrJQYjPXH

Malware Config

Targets

    • Target

      23dfe58789c140fb3020f9b97c4c6a9635e00fdff341e169e8683629dd810e42

    • Size

      707KB

    • MD5

      ab74fb9069dc3151aee0e4ce6287dceb

    • SHA1

      7f4a6c04c7cfacc7a9d2d4e2d46c2e6de6d36215

    • SHA256

      23dfe58789c140fb3020f9b97c4c6a9635e00fdff341e169e8683629dd810e42

    • SHA512

      74a707eca1583cb2a5a239aea2c48f62b5826ada14344db86b9d239b72cba86600012e896767291e8e31bc3510888c19446984bf8aba469f3b859cc48d424943

    • SSDEEP

      12288:7y90h+/0Z/IAgrNzZ3oRQZbpCbu8JQT+KOzn6W/cE8kmFkgK1XH:7yM+/0Z/IP1oRgtqrJQYjPXH

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks