General

  • Target

    b9e05bb59fb617049a606e8686975ccdf29a75b0193fd9487d792eb09645669d

  • Size

    706KB

  • Sample

    230423-ph2rtseh5s

  • MD5

    df7d0b04ec0be6ff0e4499522a3c12f0

  • SHA1

    1129c3e484a5632e6cde229615f858d1a3840e4e

  • SHA256

    b9e05bb59fb617049a606e8686975ccdf29a75b0193fd9487d792eb09645669d

  • SHA512

    17aaa21cec7082a48214e084e50b95ff003384ff832884d97556e55fa188c89727549aee19455d24ca953692de70291cbad37a16bc4a0ef01cad76718b38381b

  • SSDEEP

    12288:Vy904Ia8C3+NTGdC0xAxwtnZgF8AteaXMCxfjT9wmY+dg26oyzPNJeUNR1jsnj:VyiCOVDKZKtea8CxfP9wgZlyLeufQ

Malware Config

Targets

    • Target

      b9e05bb59fb617049a606e8686975ccdf29a75b0193fd9487d792eb09645669d

    • Size

      706KB

    • MD5

      df7d0b04ec0be6ff0e4499522a3c12f0

    • SHA1

      1129c3e484a5632e6cde229615f858d1a3840e4e

    • SHA256

      b9e05bb59fb617049a606e8686975ccdf29a75b0193fd9487d792eb09645669d

    • SHA512

      17aaa21cec7082a48214e084e50b95ff003384ff832884d97556e55fa188c89727549aee19455d24ca953692de70291cbad37a16bc4a0ef01cad76718b38381b

    • SSDEEP

      12288:Vy904Ia8C3+NTGdC0xAxwtnZgF8AteaXMCxfjT9wmY+dg26oyzPNJeUNR1jsnj:VyiCOVDKZKtea8CxfP9wgZlyLeufQ

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks