General

  • Target

    30dca1a27e967f1985f9e10b4fa54f1a73a9de59d8303152fb0cdded054abcf9

  • Size

    702KB

  • Sample

    230423-l8b3bacg27

  • MD5

    fae1766f0fa762b9ffa72c2e02c8584a

  • SHA1

    63e69ee757342c008ec9d9bd2bb4601a6d482123

  • SHA256

    30dca1a27e967f1985f9e10b4fa54f1a73a9de59d8303152fb0cdded054abcf9

  • SHA512

    968513775bdc84ff2082eca9dd1bfe5df17a681a816d88c528a06efbada7c17accc86801c76512a7be0822a4c66ff336bc313542d747d61255fcfeb857285829

  • SSDEEP

    12288:Py90wozfqMznx4Wq8J5HPq+ayba1ESMWn/VSn1yImtTBDKX:PyBojHznx4WqkHPq+aYa1EVW/V41yImI

Malware Config

Targets

    • Target

      30dca1a27e967f1985f9e10b4fa54f1a73a9de59d8303152fb0cdded054abcf9

    • Size

      702KB

    • MD5

      fae1766f0fa762b9ffa72c2e02c8584a

    • SHA1

      63e69ee757342c008ec9d9bd2bb4601a6d482123

    • SHA256

      30dca1a27e967f1985f9e10b4fa54f1a73a9de59d8303152fb0cdded054abcf9

    • SHA512

      968513775bdc84ff2082eca9dd1bfe5df17a681a816d88c528a06efbada7c17accc86801c76512a7be0822a4c66ff336bc313542d747d61255fcfeb857285829

    • SSDEEP

      12288:Py90wozfqMznx4Wq8J5HPq+ayba1ESMWn/VSn1yImtTBDKX:PyBojHznx4WqkHPq+aYa1EVW/V41yImI

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks