General

  • Target

    efc43aa9b90e00190047ff74dce04cbf656eedb844d0747ef2f1d59dd0a2f744

  • Size

    746KB

  • Sample

    230424-t4s42adb59

  • MD5

    e2a9d103dad573c93ed5328575dd837d

  • SHA1

    db9a09b1c527d8104a5e14910b9e816701cc204e

  • SHA256

    efc43aa9b90e00190047ff74dce04cbf656eedb844d0747ef2f1d59dd0a2f744

  • SHA512

    8ec5eedff133a826b0cf6e701e19a9a14a19cd03655e33a2b45e454ded392d6c0312ba9d7f80a2c39dee861c15c4c93d827f70458bbfab1b65c5a436ae6c2334

  • SSDEEP

    12288:oy90aG8iN31E5gnmcEZjh88lpBODzjmWwL5MS+nYQ9XfSItiZ5NoTwqX4l:oy+HN31+WbOh8opBODzolz+nh9Xf2Z5F

Malware Config

Targets

    • Target

      efc43aa9b90e00190047ff74dce04cbf656eedb844d0747ef2f1d59dd0a2f744

    • Size

      746KB

    • MD5

      e2a9d103dad573c93ed5328575dd837d

    • SHA1

      db9a09b1c527d8104a5e14910b9e816701cc204e

    • SHA256

      efc43aa9b90e00190047ff74dce04cbf656eedb844d0747ef2f1d59dd0a2f744

    • SHA512

      8ec5eedff133a826b0cf6e701e19a9a14a19cd03655e33a2b45e454ded392d6c0312ba9d7f80a2c39dee861c15c4c93d827f70458bbfab1b65c5a436ae6c2334

    • SSDEEP

      12288:oy90aG8iN31E5gnmcEZjh88lpBODzjmWwL5MS+nYQ9XfSItiZ5NoTwqX4l:oy+HN31+WbOh8opBODzolz+nh9Xf2Z5F

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks