General

  • Target

    d6dd3d159da3e10dd38d0db6c2c731431b61b15f87838e0a81215861e74f0a63

  • Size

    702KB

  • Sample

    230423-wh65wafa39

  • MD5

    dfbabf64bb8f630603b27f65ff7b8ca8

  • SHA1

    92674127086c21ff63ae0619bbced7fcd547b681

  • SHA256

    d6dd3d159da3e10dd38d0db6c2c731431b61b15f87838e0a81215861e74f0a63

  • SHA512

    f7cc117a1a8d06999733bf914f4abd59d555d4ec14fcf06b848056e0bbbe332823de3cc67c2ed45acc2b55ac0423ae25351232f697eb7853ab35e93edbf0ab80

  • SSDEEP

    12288:yy90BNGyFjoHKlBfx/Do9E+un92x/nEhX9BFG0rdeaeiRWW3tXH:yyKsmbJPn92x/nEhNB3kuRL1

Malware Config

Targets

    • Target

      d6dd3d159da3e10dd38d0db6c2c731431b61b15f87838e0a81215861e74f0a63

    • Size

      702KB

    • MD5

      dfbabf64bb8f630603b27f65ff7b8ca8

    • SHA1

      92674127086c21ff63ae0619bbced7fcd547b681

    • SHA256

      d6dd3d159da3e10dd38d0db6c2c731431b61b15f87838e0a81215861e74f0a63

    • SHA512

      f7cc117a1a8d06999733bf914f4abd59d555d4ec14fcf06b848056e0bbbe332823de3cc67c2ed45acc2b55ac0423ae25351232f697eb7853ab35e93edbf0ab80

    • SSDEEP

      12288:yy90BNGyFjoHKlBfx/Do9E+un92x/nEhX9BFG0rdeaeiRWW3tXH:yyKsmbJPn92x/nEhNB3kuRL1

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks