General

  • Target

    74c006d77feb41a3e6301e81acee77a3b5f5e8640bc3bd9c7bcdf35ece0814b6

  • Size

    703KB

  • Sample

    230423-rfkfwafd7v

  • MD5

    37f7af643c4c3cdc12e385f6457c762e

  • SHA1

    ab37aab36b0a8df706826683c0014df542647e08

  • SHA256

    74c006d77feb41a3e6301e81acee77a3b5f5e8640bc3bd9c7bcdf35ece0814b6

  • SHA512

    b07750e7c7cf67de242d1a33f67eac45b789bddb187ca9cc5229119c628dcd7540f5612d9d1143835eb076aec76bb5c6710b7b2a4e334159ab56c02dacf2535d

  • SSDEEP

    12288:iy903Mc/f6QKt30sTerBtXlB69f3maMMcYXVf/uDeSzEwurs/nQRRTl:iyGMVREsyr3rwepHYt/iQ+nQRX

Malware Config

Targets

    • Target

      74c006d77feb41a3e6301e81acee77a3b5f5e8640bc3bd9c7bcdf35ece0814b6

    • Size

      703KB

    • MD5

      37f7af643c4c3cdc12e385f6457c762e

    • SHA1

      ab37aab36b0a8df706826683c0014df542647e08

    • SHA256

      74c006d77feb41a3e6301e81acee77a3b5f5e8640bc3bd9c7bcdf35ece0814b6

    • SHA512

      b07750e7c7cf67de242d1a33f67eac45b789bddb187ca9cc5229119c628dcd7540f5612d9d1143835eb076aec76bb5c6710b7b2a4e334159ab56c02dacf2535d

    • SSDEEP

      12288:iy903Mc/f6QKt30sTerBtXlB69f3maMMcYXVf/uDeSzEwurs/nQRRTl:iyGMVREsyr3rwepHYt/iQ+nQRX

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks