General

  • Target

    87a12633529b7b44c3fc2172ca9cb360667ac8ec48a96d78f17d774749096fb4

  • Size

    705KB

  • Sample

    230423-t8v47aef49

  • MD5

    04a1322842371303c7fc010739109542

  • SHA1

    8a3ebc01894bbc2c91f2c7e3b291e0fa78fa8107

  • SHA256

    87a12633529b7b44c3fc2172ca9cb360667ac8ec48a96d78f17d774749096fb4

  • SHA512

    ff6190cf8bf9a402ccd9e58e1a885fcff91e0475c49b668917aeed3585de5dd4adfe7ce33af041abcc2b6d1dc08bbf36e44f250d479acf4a496e5673c9906d95

  • SSDEEP

    12288:ly90aaqU/8M+GZyXdg+/Difnirh7jvVT3MKF4cmBl5kE0kFaOMytLkad:lyO1/P+vi+biirhtrMK+cglCE01+

Malware Config

Targets

    • Target

      87a12633529b7b44c3fc2172ca9cb360667ac8ec48a96d78f17d774749096fb4

    • Size

      705KB

    • MD5

      04a1322842371303c7fc010739109542

    • SHA1

      8a3ebc01894bbc2c91f2c7e3b291e0fa78fa8107

    • SHA256

      87a12633529b7b44c3fc2172ca9cb360667ac8ec48a96d78f17d774749096fb4

    • SHA512

      ff6190cf8bf9a402ccd9e58e1a885fcff91e0475c49b668917aeed3585de5dd4adfe7ce33af041abcc2b6d1dc08bbf36e44f250d479acf4a496e5673c9906d95

    • SSDEEP

      12288:ly90aaqU/8M+GZyXdg+/Difnirh7jvVT3MKF4cmBl5kE0kFaOMytLkad:lyO1/P+vi+biirhtrMK+cglCE01+

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks