General

  • Target

    0464d1e83bb0d2f0c6401b7411d7c64c6c23a4ff2aa5df1053c9eabcb3e490c7

  • Size

    695KB

  • Sample

    230423-bq89zsaa25

  • MD5

    61bca7edfb33086152e1b00df4797f9f

  • SHA1

    1a44dc250603644ab02703a4539c5465c8a869bb

  • SHA256

    0464d1e83bb0d2f0c6401b7411d7c64c6c23a4ff2aa5df1053c9eabcb3e490c7

  • SHA512

    118923b277b7b85c0b3661dfa07a39865f7aa76dcf171b11c709edc056ab4085a5b4a57c54b06ece054577d20a3a3184deece0bf022db69d82f572137868d53e

  • SSDEEP

    12288:+y90qwBUZaKXYUzbM2QXh5OAPhlzl9qVLa4DDnEpBzFzRqoNw2p:+yh0UBuqUiVgLNw2p

Malware Config

Targets

    • Target

      0464d1e83bb0d2f0c6401b7411d7c64c6c23a4ff2aa5df1053c9eabcb3e490c7

    • Size

      695KB

    • MD5

      61bca7edfb33086152e1b00df4797f9f

    • SHA1

      1a44dc250603644ab02703a4539c5465c8a869bb

    • SHA256

      0464d1e83bb0d2f0c6401b7411d7c64c6c23a4ff2aa5df1053c9eabcb3e490c7

    • SHA512

      118923b277b7b85c0b3661dfa07a39865f7aa76dcf171b11c709edc056ab4085a5b4a57c54b06ece054577d20a3a3184deece0bf022db69d82f572137868d53e

    • SSDEEP

      12288:+y90qwBUZaKXYUzbM2QXh5OAPhlzl9qVLa4DDnEpBzFzRqoNw2p:+yh0UBuqUiVgLNw2p

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks