General

  • Target

    bb7d77a7b1b33b9efba3b5d5c5ecda4e71300ef0cca2cf339c1505e6dea92320

  • Size

    696KB

  • Sample

    230422-vqfgfshe7s

  • MD5

    76bd0e8ca72fdb4a1dc0b60cff9b68d9

  • SHA1

    d418750dafb4a542eac4489a9ad062cdfc788ac7

  • SHA256

    bb7d77a7b1b33b9efba3b5d5c5ecda4e71300ef0cca2cf339c1505e6dea92320

  • SHA512

    8c41a246b6570d27a5df35e625bd44cfd0800ada5dae15e138c6d1a5118a19ba887527aa8bd02a6fdbf55bb4f0e176323e3c36ef6a33dbd3dcfce2320e3bc010

  • SSDEEP

    12288:Sy90mPqbHdfh4yPWxMgwxLiX+0WaMpPYzbIWIOINza09SvYIVESMmn:Sy5yTdS1xgxeO0W5PYXvR4za0EYQ/

Malware Config

Targets

    • Target

      bb7d77a7b1b33b9efba3b5d5c5ecda4e71300ef0cca2cf339c1505e6dea92320

    • Size

      696KB

    • MD5

      76bd0e8ca72fdb4a1dc0b60cff9b68d9

    • SHA1

      d418750dafb4a542eac4489a9ad062cdfc788ac7

    • SHA256

      bb7d77a7b1b33b9efba3b5d5c5ecda4e71300ef0cca2cf339c1505e6dea92320

    • SHA512

      8c41a246b6570d27a5df35e625bd44cfd0800ada5dae15e138c6d1a5118a19ba887527aa8bd02a6fdbf55bb4f0e176323e3c36ef6a33dbd3dcfce2320e3bc010

    • SSDEEP

      12288:Sy90mPqbHdfh4yPWxMgwxLiX+0WaMpPYzbIWIOINza09SvYIVESMmn:Sy5yTdS1xgxeO0W5PYXvR4za0EYQ/

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks