General

  • Target

    a24b066e1dbd809103d7ab42cf41645a6097514d48adc4f054ae8a2ae48dff44

  • Size

    560KB

  • Sample

    230422-y2hmqsac21

  • MD5

    a6d37d42960691771929ff71e45ced05

  • SHA1

    ff4ba10d0f5686657a3b9a168cdfa6bf4eac513f

  • SHA256

    a24b066e1dbd809103d7ab42cf41645a6097514d48adc4f054ae8a2ae48dff44

  • SHA512

    d5efdf0189d76239037c8606bc6eeaef5a68df411e4ec7b619c75a18ab4cdcb11a8254b0c316c8eb1fc5a9332f7d7652516c4a2dffeae813fe0216d14eb49df2

  • SSDEEP

    12288:Dy90ag+qOULNI44IePQGVsGiaLYVoXs5jWHR:DyO+ONI44pvVhia2J0

Malware Config

Targets

    • Target

      a24b066e1dbd809103d7ab42cf41645a6097514d48adc4f054ae8a2ae48dff44

    • Size

      560KB

    • MD5

      a6d37d42960691771929ff71e45ced05

    • SHA1

      ff4ba10d0f5686657a3b9a168cdfa6bf4eac513f

    • SHA256

      a24b066e1dbd809103d7ab42cf41645a6097514d48adc4f054ae8a2ae48dff44

    • SHA512

      d5efdf0189d76239037c8606bc6eeaef5a68df411e4ec7b619c75a18ab4cdcb11a8254b0c316c8eb1fc5a9332f7d7652516c4a2dffeae813fe0216d14eb49df2

    • SSDEEP

      12288:Dy90ag+qOULNI44IePQGVsGiaLYVoXs5jWHR:DyO+ONI44pvVhia2J0

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks