General

  • Target

    3cda65c75e8de0b35f541143eca84edc3da96c1cee8828675a3fc909089d3f8a

  • Size

    560KB

  • Sample

    230422-wgd3psga42

  • MD5

    4348aeeafdabfc04d930aa90e2d53b76

  • SHA1

    fdba781d7c2cf04ce9ba43a6cc444bf0efde8aa2

  • SHA256

    3cda65c75e8de0b35f541143eca84edc3da96c1cee8828675a3fc909089d3f8a

  • SHA512

    ac21550325156b75e759b4ac1bc8de46e31910bb14397f6ba2ff81922447372a57dc8b06bfa2836d9684cc1978dd134e028e893d706e777e3d58970129e3f2c6

  • SSDEEP

    12288:jy90pAwBmGpNnINU9/QhS633T3w09SuuRnpD:jyZwBmGpWyB8j3w0d4nF

Malware Config

Targets

    • Target

      3cda65c75e8de0b35f541143eca84edc3da96c1cee8828675a3fc909089d3f8a

    • Size

      560KB

    • MD5

      4348aeeafdabfc04d930aa90e2d53b76

    • SHA1

      fdba781d7c2cf04ce9ba43a6cc444bf0efde8aa2

    • SHA256

      3cda65c75e8de0b35f541143eca84edc3da96c1cee8828675a3fc909089d3f8a

    • SHA512

      ac21550325156b75e759b4ac1bc8de46e31910bb14397f6ba2ff81922447372a57dc8b06bfa2836d9684cc1978dd134e028e893d706e777e3d58970129e3f2c6

    • SSDEEP

      12288:jy90pAwBmGpNnINU9/QhS633T3w09SuuRnpD:jyZwBmGpWyB8j3w0d4nF

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks