General

  • Target

    75f573f2b242de506a19f3b51b05810aba02bb15004c217ad9b64a1a1a24b6c8

  • Size

    696KB

  • Sample

    230422-yvzmnsge46

  • MD5

    1e4b66e24d5c73dd68effeca02fad7a6

  • SHA1

    ea3db14289908b705c28e99d163be2d04a83a14a

  • SHA256

    75f573f2b242de506a19f3b51b05810aba02bb15004c217ad9b64a1a1a24b6c8

  • SHA512

    80212ef72b82612fed4d7392348c876ca109949d8705cd42e0b0d9e7a428c0b58c53308e277390a2181dbf1c5fb53e9f948206efa641adbeaf3767edd06f8715

  • SSDEEP

    12288:my90RZC4wwirhHNUtVZjfkYUr04//ABMqGkTe345X8VyAHT:myGyw2HNUtVZjMD//IBMvkTzoFz

Malware Config

Targets

    • Target

      75f573f2b242de506a19f3b51b05810aba02bb15004c217ad9b64a1a1a24b6c8

    • Size

      696KB

    • MD5

      1e4b66e24d5c73dd68effeca02fad7a6

    • SHA1

      ea3db14289908b705c28e99d163be2d04a83a14a

    • SHA256

      75f573f2b242de506a19f3b51b05810aba02bb15004c217ad9b64a1a1a24b6c8

    • SHA512

      80212ef72b82612fed4d7392348c876ca109949d8705cd42e0b0d9e7a428c0b58c53308e277390a2181dbf1c5fb53e9f948206efa641adbeaf3767edd06f8715

    • SSDEEP

      12288:my90RZC4wwirhHNUtVZjfkYUr04//ABMqGkTe345X8VyAHT:myGyw2HNUtVZjMD//IBMvkTzoFz

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks