General

  • Target

    552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8

  • Size

    707KB

  • Sample

    230422-mp84daed44

  • MD5

    c927bd121b07f0d863804dc458ca4055

  • SHA1

    484f946abc1dde296d00512be3a46bba1d85e793

  • SHA256

    552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8

  • SHA512

    bb6499d94749bd9f81e4eae88c95c9521855b41cd0d86bf5acb5dce6dc22abdfd5bdd5064eb09074eb22c706413325763029b47237b0e4e730a495a447096fed

  • SSDEEP

    12288:Jy90agTemBNIAjUjKmw+DPRVGcqu97uOJk6c/cQ8sAbokr:Jy+Tem2KD+LRVGsFUhGoQ

Malware Config

Targets

    • Target

      552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8

    • Size

      707KB

    • MD5

      c927bd121b07f0d863804dc458ca4055

    • SHA1

      484f946abc1dde296d00512be3a46bba1d85e793

    • SHA256

      552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8

    • SHA512

      bb6499d94749bd9f81e4eae88c95c9521855b41cd0d86bf5acb5dce6dc22abdfd5bdd5064eb09074eb22c706413325763029b47237b0e4e730a495a447096fed

    • SSDEEP

      12288:Jy90agTemBNIAjUjKmw+DPRVGcqu97uOJk6c/cQ8sAbokr:Jy+Tem2KD+LRVGsFUhGoQ

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks