General

  • Target

    a65263a7ba3e6dbd64c9b5f0997eabb9a641cf1589d904a44ef9a58bc1c544a2

  • Size

    617KB

  • Sample

    230424-lm3yxaah93

  • MD5

    7a07b539c79a3c78ff900a60c26c1be6

  • SHA1

    c073d76cc9605185bd3865baf1261d2ad5a7cb41

  • SHA256

    a65263a7ba3e6dbd64c9b5f0997eabb9a641cf1589d904a44ef9a58bc1c544a2

  • SHA512

    16d4d81d63c62f9bbb51357527eeba81a0cb0058be123076485c9b3a8f595a735edb5023378b462386ef70947836c97108db33f02a2655c558fa027854519f36

  • SSDEEP

    12288:3y903XwGUpEK0jU3tVlu4dymwxdfVDW0nZfOq:3y0wGU2K1LluAyrJVPP

Malware Config

Targets

    • Target

      a65263a7ba3e6dbd64c9b5f0997eabb9a641cf1589d904a44ef9a58bc1c544a2

    • Size

      617KB

    • MD5

      7a07b539c79a3c78ff900a60c26c1be6

    • SHA1

      c073d76cc9605185bd3865baf1261d2ad5a7cb41

    • SHA256

      a65263a7ba3e6dbd64c9b5f0997eabb9a641cf1589d904a44ef9a58bc1c544a2

    • SHA512

      16d4d81d63c62f9bbb51357527eeba81a0cb0058be123076485c9b3a8f595a735edb5023378b462386ef70947836c97108db33f02a2655c558fa027854519f36

    • SSDEEP

      12288:3y903XwGUpEK0jU3tVlu4dymwxdfVDW0nZfOq:3y0wGU2K1LluAyrJVPP

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks