General

  • Target

    b0783ce14c8aa66227f2faf159683ae5064492d0357f539d299998f755a3c478

  • Size

    566KB

  • Sample

    230423-h5sn4sde6t

  • MD5

    c0ce0a92b49c1ce0d7280ec5a75eaf36

  • SHA1

    bf20c0aa800455bb21ac39caffd018e7848a1458

  • SHA256

    b0783ce14c8aa66227f2faf159683ae5064492d0357f539d299998f755a3c478

  • SHA512

    adb12c4a2603d6fb44b9aece30d02568160c1b918db365f656e3f2319c76516a1d4ee0dda088397098a00ef8e45776b1e1fb3372e04a5a8ca2db66e1410728eb

  • SSDEEP

    12288:Fy90z//w6RExvPWwgstPz/5zjuUAP2vF9miXZjWyuiDtLDN3KzJT:FyS/Y6RExGfsZYD2N9mipjpLN3St

Malware Config

Targets

    • Target

      b0783ce14c8aa66227f2faf159683ae5064492d0357f539d299998f755a3c478

    • Size

      566KB

    • MD5

      c0ce0a92b49c1ce0d7280ec5a75eaf36

    • SHA1

      bf20c0aa800455bb21ac39caffd018e7848a1458

    • SHA256

      b0783ce14c8aa66227f2faf159683ae5064492d0357f539d299998f755a3c478

    • SHA512

      adb12c4a2603d6fb44b9aece30d02568160c1b918db365f656e3f2319c76516a1d4ee0dda088397098a00ef8e45776b1e1fb3372e04a5a8ca2db66e1410728eb

    • SSDEEP

      12288:Fy90z//w6RExvPWwgstPz/5zjuUAP2vF9miXZjWyuiDtLDN3KzJT:FyS/Y6RExGfsZYD2N9mipjpLN3St

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks