General

  • Target

    2edd695165619f087e7449720acfc1b6c251dbc6ae1786851b94b2f2c88e4075

  • Size

    559KB

  • Sample

    230422-ty4nksff84

  • MD5

    76e63ecad08eddf84f5001882299654f

  • SHA1

    29549a8ec427d22f70765c830238fe3792111480

  • SHA256

    2edd695165619f087e7449720acfc1b6c251dbc6ae1786851b94b2f2c88e4075

  • SHA512

    ab7a8921217af234632786f107a776137ed1bcd6e813a93976b47a3e4271e44e6632979eb3361ca8cc83c2d1709f43029ae00cce2466647a299dbe7daab6c4e5

  • SSDEEP

    12288:Qy90rtb3+Azsq9Kd0E3UQRs9qwnSS5DoyYD42kF29BKMVFbBXKo654O2V:QyizzD9fEEVqohlJg9UaNaF2V

Malware Config

Targets

    • Target

      2edd695165619f087e7449720acfc1b6c251dbc6ae1786851b94b2f2c88e4075

    • Size

      559KB

    • MD5

      76e63ecad08eddf84f5001882299654f

    • SHA1

      29549a8ec427d22f70765c830238fe3792111480

    • SHA256

      2edd695165619f087e7449720acfc1b6c251dbc6ae1786851b94b2f2c88e4075

    • SHA512

      ab7a8921217af234632786f107a776137ed1bcd6e813a93976b47a3e4271e44e6632979eb3361ca8cc83c2d1709f43029ae00cce2466647a299dbe7daab6c4e5

    • SSDEEP

      12288:Qy90rtb3+Azsq9Kd0E3UQRs9qwnSS5DoyYD42kF29BKMVFbBXKo654O2V:QyizzD9fEEVqohlJg9UaNaF2V

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks