General

  • Target

    860a43b58d1ff2d264632d39ab83c40c0b2b4bbbe3ece32f2dd0ca5545e11deb

  • Size

    702KB

  • Sample

    230423-dy1nxscc9w

  • MD5

    eb7decac38393d58d0705e72736f1535

  • SHA1

    902f68fcbf3f0531435ec249949264652a353129

  • SHA256

    860a43b58d1ff2d264632d39ab83c40c0b2b4bbbe3ece32f2dd0ca5545e11deb

  • SHA512

    a0a40e579c0fa43834b23cf0a2680362f8edbe3e3778628689eb0b205a30f59fc4cd449d8a3f53001767657558d7628663f9a947453a2265b4a446fd5ab28097

  • SSDEEP

    12288:Cy90u4zi6PUJT9DARfTuE7rGqRph8FjFfn1B8udtJk7p4kcQeg:CyL6sFARfyE7KqJY9KOkcQb

Malware Config

Targets

    • Target

      860a43b58d1ff2d264632d39ab83c40c0b2b4bbbe3ece32f2dd0ca5545e11deb

    • Size

      702KB

    • MD5

      eb7decac38393d58d0705e72736f1535

    • SHA1

      902f68fcbf3f0531435ec249949264652a353129

    • SHA256

      860a43b58d1ff2d264632d39ab83c40c0b2b4bbbe3ece32f2dd0ca5545e11deb

    • SHA512

      a0a40e579c0fa43834b23cf0a2680362f8edbe3e3778628689eb0b205a30f59fc4cd449d8a3f53001767657558d7628663f9a947453a2265b4a446fd5ab28097

    • SSDEEP

      12288:Cy90u4zi6PUJT9DARfTuE7rGqRph8FjFfn1B8udtJk7p4kcQeg:CyL6sFARfyE7KqJY9KOkcQb

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks