General

  • Target

    3aebddd7ae3b2ca357fe2fe8fd04c6031d69e75643b18c20110036243b9bee89

  • Size

    753KB

  • Sample

    230424-pvxzeabg78

  • MD5

    d7cc4eefaf96748e73825704c3175e9d

  • SHA1

    d36a436761bf2464791ad3cf5084be8f9f562da9

  • SHA256

    3aebddd7ae3b2ca357fe2fe8fd04c6031d69e75643b18c20110036243b9bee89

  • SHA512

    5352bec8db1d615ffc902caf7bc48350fe600919a6d7e10df4a97c9ca7faccfbc3826ed8a4b366f25413193b4da9c5fac6d0431c0c8a59917d51d57001940edb

  • SSDEEP

    12288:Vy907eL8AOz47yZIpUN3MF7I7HSNtBvEn6bHBrJzQVq4pxKQTTjSLkPNst:VyL8Z00WU5MF7IGNDvEMBrvCKQTTGQPE

Malware Config

Targets

    • Target

      3aebddd7ae3b2ca357fe2fe8fd04c6031d69e75643b18c20110036243b9bee89

    • Size

      753KB

    • MD5

      d7cc4eefaf96748e73825704c3175e9d

    • SHA1

      d36a436761bf2464791ad3cf5084be8f9f562da9

    • SHA256

      3aebddd7ae3b2ca357fe2fe8fd04c6031d69e75643b18c20110036243b9bee89

    • SHA512

      5352bec8db1d615ffc902caf7bc48350fe600919a6d7e10df4a97c9ca7faccfbc3826ed8a4b366f25413193b4da9c5fac6d0431c0c8a59917d51d57001940edb

    • SSDEEP

      12288:Vy907eL8AOz47yZIpUN3MF7I7HSNtBvEn6bHBrJzQVq4pxKQTTjSLkPNst:VyL8Z00WU5MF7IGNDvEMBrvCKQTTGQPE

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks