General

  • Target

    1a664b472a89aff91cd731e9960f19a66ece70add2f78e73b39ec4d740d7a9d4

  • Size

    703KB

  • Sample

    230423-z9gk3sga48

  • MD5

    611c907212be0a3ed6a05ce1f5043873

  • SHA1

    ab3749e0e10e032ccde3ab6dccce3b9be2b9f10f

  • SHA256

    1a664b472a89aff91cd731e9960f19a66ece70add2f78e73b39ec4d740d7a9d4

  • SHA512

    f34667227834f381770ea61269daa678752b94fe378e98d28a54cec7ced1e680ca757e441b2d516ca9818e9aced84a1240c9b501b582b62d3b02b5927a20c91e

  • SSDEEP

    12288:ly90BIKCgasze4AIj6kTKdMMq7p7Y43tLI1KzCKxIzOMhy/K/4s+:ly8EgaYtB1b0iHxIaOCs+

Malware Config

Targets

    • Target

      1a664b472a89aff91cd731e9960f19a66ece70add2f78e73b39ec4d740d7a9d4

    • Size

      703KB

    • MD5

      611c907212be0a3ed6a05ce1f5043873

    • SHA1

      ab3749e0e10e032ccde3ab6dccce3b9be2b9f10f

    • SHA256

      1a664b472a89aff91cd731e9960f19a66ece70add2f78e73b39ec4d740d7a9d4

    • SHA512

      f34667227834f381770ea61269daa678752b94fe378e98d28a54cec7ced1e680ca757e441b2d516ca9818e9aced84a1240c9b501b582b62d3b02b5927a20c91e

    • SSDEEP

      12288:ly90BIKCgasze4AIj6kTKdMMq7p7Y43tLI1KzCKxIzOMhy/K/4s+:ly8EgaYtB1b0iHxIaOCs+

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks