General

  • Target

    ca507800556a0b039f6065d843611c0213c1eb1a13f65d43ce5317d16630b386

  • Size

    696KB

  • Sample

    230422-z1z13aad9v

  • MD5

    5c1f21f23231312f3736315b583d0846

  • SHA1

    7b7602f439f3d5bf2f4a17374fe8228172efbded

  • SHA256

    ca507800556a0b039f6065d843611c0213c1eb1a13f65d43ce5317d16630b386

  • SHA512

    bf3633f9c90ecd89d35c0df99ef59c89313b78f1791da9eed2b7640fb28c20cdd01b38e1a6bdeed6ffef7dbcd25bbed65022d8230faa0fd65b852dc54db4c90c

  • SSDEEP

    12288:gy90Snv7/uZ/VETPCoo8ONXfR7q08rOtDum0wEP78xzuYeUcYI4xO9G5N:gyHv7s/VEQddqOAmKWuYHnO4N

Malware Config

Targets

    • Target

      ca507800556a0b039f6065d843611c0213c1eb1a13f65d43ce5317d16630b386

    • Size

      696KB

    • MD5

      5c1f21f23231312f3736315b583d0846

    • SHA1

      7b7602f439f3d5bf2f4a17374fe8228172efbded

    • SHA256

      ca507800556a0b039f6065d843611c0213c1eb1a13f65d43ce5317d16630b386

    • SHA512

      bf3633f9c90ecd89d35c0df99ef59c89313b78f1791da9eed2b7640fb28c20cdd01b38e1a6bdeed6ffef7dbcd25bbed65022d8230faa0fd65b852dc54db4c90c

    • SSDEEP

      12288:gy90Snv7/uZ/VETPCoo8ONXfR7q08rOtDum0wEP78xzuYeUcYI4xO9G5N:gyHv7s/VEQddqOAmKWuYHnO4N

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks