General

  • Target

    8ef8fb27f1051a1c2aecd6fe5d2d0f555abeb2a880b0cd75b50add99e3bf73da

  • Size

    559KB

  • Sample

    230422-z77dqaae4w

  • MD5

    5c9ef1792f5af4bd5602a35f680bab66

  • SHA1

    e5fd7972cc2cb5670dd560da0824c85efce38c3f

  • SHA256

    8ef8fb27f1051a1c2aecd6fe5d2d0f555abeb2a880b0cd75b50add99e3bf73da

  • SHA512

    4c435145f8db36574d50c65cbea5bd6f470c7f142b74829e7c2fe9c7f967b45bc4ec06307242c76a37a6818db9414ef76c2545f4fce02c8380d153572a8730c1

  • SSDEEP

    12288:sy90R7GWljQX7PVniwss6ukeEct/GjjpNZMR4:syo7zUX5niwsukjNZMR4

Malware Config

Targets

    • Target

      8ef8fb27f1051a1c2aecd6fe5d2d0f555abeb2a880b0cd75b50add99e3bf73da

    • Size

      559KB

    • MD5

      5c9ef1792f5af4bd5602a35f680bab66

    • SHA1

      e5fd7972cc2cb5670dd560da0824c85efce38c3f

    • SHA256

      8ef8fb27f1051a1c2aecd6fe5d2d0f555abeb2a880b0cd75b50add99e3bf73da

    • SHA512

      4c435145f8db36574d50c65cbea5bd6f470c7f142b74829e7c2fe9c7f967b45bc4ec06307242c76a37a6818db9414ef76c2545f4fce02c8380d153572a8730c1

    • SSDEEP

      12288:sy90R7GWljQX7PVniwss6ukeEct/GjjpNZMR4:syo7zUX5niwsukjNZMR4

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks