General

  • Target

    8845a4d0e5accecedfb1c2f9d2b3278dbbf8007b49f39304551f573ef59193e1

  • Size

    707KB

  • Sample

    230423-fk1g4scg4s

  • MD5

    b17fb1dc2118641c9769074d2b856bab

  • SHA1

    0f08e7f20dceba9601a7f1c4c760f4a4e130ae62

  • SHA256

    8845a4d0e5accecedfb1c2f9d2b3278dbbf8007b49f39304551f573ef59193e1

  • SHA512

    082fc77fbf6f5b726d8e8fa908e46c528c45f5647583025c65ed11816ffc9c5fed31ca2984e92b25810c5ec09e88f1d63e0b16e49ee0cafc64d2ca73d3d75ddd

  • SSDEEP

    12288:Dy90O4mgwveG/4frv/DQdZlDpPcATj/FGEypBONqFTn16quTVJSdwu1lR:DybpvX/ckmMj/IEaXRZX1lR

Malware Config

Targets

    • Target

      8845a4d0e5accecedfb1c2f9d2b3278dbbf8007b49f39304551f573ef59193e1

    • Size

      707KB

    • MD5

      b17fb1dc2118641c9769074d2b856bab

    • SHA1

      0f08e7f20dceba9601a7f1c4c760f4a4e130ae62

    • SHA256

      8845a4d0e5accecedfb1c2f9d2b3278dbbf8007b49f39304551f573ef59193e1

    • SHA512

      082fc77fbf6f5b726d8e8fa908e46c528c45f5647583025c65ed11816ffc9c5fed31ca2984e92b25810c5ec09e88f1d63e0b16e49ee0cafc64d2ca73d3d75ddd

    • SSDEEP

      12288:Dy90O4mgwveG/4frv/DQdZlDpPcATj/FGEypBONqFTn16quTVJSdwu1lR:DybpvX/ckmMj/IEaXRZX1lR

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks