General

  • Target

    9812300fcfdeea5dd33aa5db14a82ef6cc607723b5c5f6c117f470e4319a3858

  • Size

    566KB

  • Sample

    230423-n9jvnaeg8z

  • MD5

    b3a6b8309ced50f4dd0a62a181326281

  • SHA1

    333be993058af85a903af9b81b009cb65c0a71f3

  • SHA256

    9812300fcfdeea5dd33aa5db14a82ef6cc607723b5c5f6c117f470e4319a3858

  • SHA512

    39235e5ab8f671340a13466b7975720baab746b2984ec99ef7ec6b133e0a5840b8c4c65af0a9995fb8ea4900422be7cbf14984f377c05ce642230ff460d2b2db

  • SSDEEP

    12288:ry906mescye+4h3QRdc3Eoy/PJGBog+SUQkr:ryFJs5e+CQRkTyQBfRUNr

Malware Config

Targets

    • Target

      9812300fcfdeea5dd33aa5db14a82ef6cc607723b5c5f6c117f470e4319a3858

    • Size

      566KB

    • MD5

      b3a6b8309ced50f4dd0a62a181326281

    • SHA1

      333be993058af85a903af9b81b009cb65c0a71f3

    • SHA256

      9812300fcfdeea5dd33aa5db14a82ef6cc607723b5c5f6c117f470e4319a3858

    • SHA512

      39235e5ab8f671340a13466b7975720baab746b2984ec99ef7ec6b133e0a5840b8c4c65af0a9995fb8ea4900422be7cbf14984f377c05ce642230ff460d2b2db

    • SSDEEP

      12288:ry906mescye+4h3QRdc3Eoy/PJGBog+SUQkr:ryFJs5e+CQRkTyQBfRUNr

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks