General

  • Target

    35e2426a08108466edf27cfa69f3df1a47a8b51ed3f95cd6d8510132d91456e4

  • Size

    560KB

  • Sample

    230423-dtx28saf55

  • MD5

    0753848dd5df589ed94665b1a1e89dd2

  • SHA1

    61f8475edd3892edce4ba1989af7c178855364fb

  • SHA256

    35e2426a08108466edf27cfa69f3df1a47a8b51ed3f95cd6d8510132d91456e4

  • SHA512

    1e7b6e6d348511c7769309c70c9de0ebcd217d71a31a912d9a0c1151160d01cbdb7a23a7e93b32c8cf8be3f5b024d4ce42bbece311162f3d1fe761961ab08727

  • SSDEEP

    12288:vy90yoILU7RnL8pvvU0jIBBWph/LJFTH1BAudVJZm550N1tXT:vyhnLWLmvvUkIazhy54NXT

Malware Config

Targets

    • Target

      35e2426a08108466edf27cfa69f3df1a47a8b51ed3f95cd6d8510132d91456e4

    • Size

      560KB

    • MD5

      0753848dd5df589ed94665b1a1e89dd2

    • SHA1

      61f8475edd3892edce4ba1989af7c178855364fb

    • SHA256

      35e2426a08108466edf27cfa69f3df1a47a8b51ed3f95cd6d8510132d91456e4

    • SHA512

      1e7b6e6d348511c7769309c70c9de0ebcd217d71a31a912d9a0c1151160d01cbdb7a23a7e93b32c8cf8be3f5b024d4ce42bbece311162f3d1fe761961ab08727

    • SSDEEP

      12288:vy90yoILU7RnL8pvvU0jIBBWph/LJFTH1BAudVJZm550N1tXT:vyhnLWLmvvUkIazhy54NXT

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks