General

  • Target

    41a1bb6952c57f0a913f8db1d7fe5fa3449ca96c93aa4c7731558bc08b4eaf55

  • Size

    1.0MB

  • Sample

    230424-agrg5sac71

  • MD5

    c4b993de3032458df2795638deba7197

  • SHA1

    3ce2dac608e0aa4f9fbd6d26d21201aa36a03c44

  • SHA256

    41a1bb6952c57f0a913f8db1d7fe5fa3449ca96c93aa4c7731558bc08b4eaf55

  • SHA512

    fa107c84ebe7d2b56c79b0f1759aea8e10829d6d7f4b9397e8296c4b8839fe648c70a93c4017f639433f5a620af8f1a8918611ae4fed6ea9317d450104610f44

  • SSDEEP

    24576:dcIu58c6Od3W36hmxGaKc1HIcf0ErjxO+TtR1N2VRDrcG3:JmZ6Od3WqFaKc1Hh8ErdOWR1N2fDrc

Malware Config

Targets

    • Target

      41a1bb6952c57f0a913f8db1d7fe5fa3449ca96c93aa4c7731558bc08b4eaf55

    • Size

      1.0MB

    • MD5

      c4b993de3032458df2795638deba7197

    • SHA1

      3ce2dac608e0aa4f9fbd6d26d21201aa36a03c44

    • SHA256

      41a1bb6952c57f0a913f8db1d7fe5fa3449ca96c93aa4c7731558bc08b4eaf55

    • SHA512

      fa107c84ebe7d2b56c79b0f1759aea8e10829d6d7f4b9397e8296c4b8839fe648c70a93c4017f639433f5a620af8f1a8918611ae4fed6ea9317d450104610f44

    • SSDEEP

      24576:dcIu58c6Od3W36hmxGaKc1HIcf0ErjxO+TtR1N2VRDrcG3:JmZ6Od3WqFaKc1Hh8ErdOWR1N2fDrc

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks