General

  • Target

    06984a2cb1cbfda09c715c42c27203cc64b75115dc7c04d3020304ac21256722

  • Size

    748KB

  • Sample

    230424-smjnlaed3y

  • MD5

    6ca2f95615b6e708416938b8572305d2

  • SHA1

    b031e04e91148993940a0728406fac8e9c89f5bf

  • SHA256

    06984a2cb1cbfda09c715c42c27203cc64b75115dc7c04d3020304ac21256722

  • SHA512

    efb46b43c5bf86a15bdc212c901d016b4c935ac8ccb60df99d9f977e1af376e799e9cec9b29694e6b455cf391d664ea428cce0b6118fc905a7aa228b82a3ed3e

  • SSDEEP

    12288:2y90AHUbY5WtjVMBzt3NyVYmeL7ImqtkNnlq/KdFakudRoDd+KEvk+U6Z:2yVsqWtjWh9sVYmLtunFWIB+kA

Malware Config

Targets

    • Target

      06984a2cb1cbfda09c715c42c27203cc64b75115dc7c04d3020304ac21256722

    • Size

      748KB

    • MD5

      6ca2f95615b6e708416938b8572305d2

    • SHA1

      b031e04e91148993940a0728406fac8e9c89f5bf

    • SHA256

      06984a2cb1cbfda09c715c42c27203cc64b75115dc7c04d3020304ac21256722

    • SHA512

      efb46b43c5bf86a15bdc212c901d016b4c935ac8ccb60df99d9f977e1af376e799e9cec9b29694e6b455cf391d664ea428cce0b6118fc905a7aa228b82a3ed3e

    • SSDEEP

      12288:2y90AHUbY5WtjVMBzt3NyVYmeL7ImqtkNnlq/KdFakudRoDd+KEvk+U6Z:2yVsqWtjWh9sVYmLtunFWIB+kA

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks