General

  • Target

    4fd2860a85c35624b09f260c2a8121432933a573faa96a0efe50432153a205fb

  • Size

    618KB

  • Sample

    230424-k76pvscf3s

  • MD5

    3362f1ff203bc2d9e769122af3f4de3e

  • SHA1

    fe9d0e2cb652ae36505c01a039c96beabddc05fb

  • SHA256

    4fd2860a85c35624b09f260c2a8121432933a573faa96a0efe50432153a205fb

  • SHA512

    08fda91830802d54ef5aa427d2bfcaa90087a249b6f29bb5f12c397de41ea93c2b24d189ea6ee14f2b0dc647d1ea9c12f1df2b3f39e17e18cf06d154ef061b76

  • SSDEEP

    12288:7y90dri0BukTQJ4Q6jEJSVnBrxoYMxjTHhzIc5qUY9lxv:7yizRTRQ6j/nUY4VzIc4xv

Malware Config

Targets

    • Target

      4fd2860a85c35624b09f260c2a8121432933a573faa96a0efe50432153a205fb

    • Size

      618KB

    • MD5

      3362f1ff203bc2d9e769122af3f4de3e

    • SHA1

      fe9d0e2cb652ae36505c01a039c96beabddc05fb

    • SHA256

      4fd2860a85c35624b09f260c2a8121432933a573faa96a0efe50432153a205fb

    • SHA512

      08fda91830802d54ef5aa427d2bfcaa90087a249b6f29bb5f12c397de41ea93c2b24d189ea6ee14f2b0dc647d1ea9c12f1df2b3f39e17e18cf06d154ef061b76

    • SSDEEP

      12288:7y90dri0BukTQJ4Q6jEJSVnBrxoYMxjTHhzIc5qUY9lxv:7yizRTRQ6j/nUY4VzIc4xv

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks