General

  • Target

    d5d88d23cda70f1860a2e17959eb5c39f96b2ee76bb048962ff23c58693a6aab

  • Size

    706KB

  • Sample

    230423-kb4wdsdh2w

  • MD5

    e7c05bc26b5b80b4821ebf4c74f508eb

  • SHA1

    9aba2a0082ee2ab851bdae670479ec3d9e15b371

  • SHA256

    d5d88d23cda70f1860a2e17959eb5c39f96b2ee76bb048962ff23c58693a6aab

  • SHA512

    3282dbbf7cc52efe3711f678c089bb1176f2f519268b5c728db86c96f3365f4712b7e804640836c106b038d923130d1a8d1c5b923a1ee801221f4851eca2690b

  • SSDEEP

    12288:Wy90zKeznuX1YoDHtnuO+2T5w3pfplAb4EbdTh8DBAYiGYYS:WyaKwxMnul2T2tplAb4EJo5if

Malware Config

Targets

    • Target

      d5d88d23cda70f1860a2e17959eb5c39f96b2ee76bb048962ff23c58693a6aab

    • Size

      706KB

    • MD5

      e7c05bc26b5b80b4821ebf4c74f508eb

    • SHA1

      9aba2a0082ee2ab851bdae670479ec3d9e15b371

    • SHA256

      d5d88d23cda70f1860a2e17959eb5c39f96b2ee76bb048962ff23c58693a6aab

    • SHA512

      3282dbbf7cc52efe3711f678c089bb1176f2f519268b5c728db86c96f3365f4712b7e804640836c106b038d923130d1a8d1c5b923a1ee801221f4851eca2690b

    • SSDEEP

      12288:Wy90zKeznuX1YoDHtnuO+2T5w3pfplAb4EbdTh8DBAYiGYYS:WyaKwxMnul2T2tplAb4EJo5if

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks