General

  • Target

    80683ebd7375a666762d4a8ed94c2221f72bfcd8c8519a980a439fe284c1f1e2

  • Size

    704KB

  • Sample

    230423-2vkejahh8s

  • MD5

    e60a99ff16f908e9f6c67d098c4cdcd5

  • SHA1

    21b38ec87a20c55b5c4f09bd38a410f04f464db7

  • SHA256

    80683ebd7375a666762d4a8ed94c2221f72bfcd8c8519a980a439fe284c1f1e2

  • SHA512

    88b92cad29ab8c3ff155dcb4ce6115463cdabd9236e66d6011d2176ca5b16556dbb3a5f2f46b693292a4d77a0c8a3db511b3261a09b51aedb37eeb1b7c95b70d

  • SSDEEP

    12288:qy901HDOgjOGSLQ1iNlTAKGjDrpToZwI1tzCNzIzbM6f/KZKI+XKVQt:qyuTjvFibOjBT4NVozIn5uKdKVe

Malware Config

Targets

    • Target

      80683ebd7375a666762d4a8ed94c2221f72bfcd8c8519a980a439fe284c1f1e2

    • Size

      704KB

    • MD5

      e60a99ff16f908e9f6c67d098c4cdcd5

    • SHA1

      21b38ec87a20c55b5c4f09bd38a410f04f464db7

    • SHA256

      80683ebd7375a666762d4a8ed94c2221f72bfcd8c8519a980a439fe284c1f1e2

    • SHA512

      88b92cad29ab8c3ff155dcb4ce6115463cdabd9236e66d6011d2176ca5b16556dbb3a5f2f46b693292a4d77a0c8a3db511b3261a09b51aedb37eeb1b7c95b70d

    • SSDEEP

      12288:qy901HDOgjOGSLQ1iNlTAKGjDrpToZwI1tzCNzIzbM6f/KZKI+XKVQt:qyuTjvFibOjBT4NVozIn5uKdKVe

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks