General

  • Target

    7812688beca6bdf840217c049f8b05019279d269e8aad161d59e138045ddc4f7

  • Size

    697KB

  • Sample

    230422-tpf6xsff48

  • MD5

    7ee7d865b109521f053d92ef53526f84

  • SHA1

    517f13146629bb25794e848c1da4717bee6f85bf

  • SHA256

    7812688beca6bdf840217c049f8b05019279d269e8aad161d59e138045ddc4f7

  • SHA512

    2a787b00dcb862336e62f2a82790f728117383cb0b7407807eb38fca6413d6c9a5c66b27d3025e304ef28eff3e65280b4f5b33c1318dbac403fb48daba479ba3

  • SSDEEP

    12288:9y90DjHp4S3tyzs/1szn/mEDbnmZrywCwmAmNWcFfbMqvbCUh6k:9yoCS3tpGXXntjA9OjMquUsk

Malware Config

Targets

    • Target

      7812688beca6bdf840217c049f8b05019279d269e8aad161d59e138045ddc4f7

    • Size

      697KB

    • MD5

      7ee7d865b109521f053d92ef53526f84

    • SHA1

      517f13146629bb25794e848c1da4717bee6f85bf

    • SHA256

      7812688beca6bdf840217c049f8b05019279d269e8aad161d59e138045ddc4f7

    • SHA512

      2a787b00dcb862336e62f2a82790f728117383cb0b7407807eb38fca6413d6c9a5c66b27d3025e304ef28eff3e65280b4f5b33c1318dbac403fb48daba479ba3

    • SSDEEP

      12288:9y90DjHp4S3tyzs/1szn/mEDbnmZrywCwmAmNWcFfbMqvbCUh6k:9yoCS3tpGXXntjA9OjMquUsk

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks