General

  • Target

    d535475a00f71bcf55aa10be4a00005b35f8721277b07cd4c73da5c3aaedb349

  • Size

    746KB

  • Sample

    230424-z2lvtsgd4s

  • MD5

    f5196113a822fecf2f0dfaec034700fc

  • SHA1

    f8b869f2f6bdb056dee305c9e0b9a06f4eb9e9fd

  • SHA256

    d535475a00f71bcf55aa10be4a00005b35f8721277b07cd4c73da5c3aaedb349

  • SHA512

    0240a94afe8f36f0f32b27cf82bcd7dbfc9562bb0855b2afbfe6a5cfec525576def9f6b602281e51bd5fb70b792e64231ca77206237c0b0d2a28b981a48e670b

  • SSDEEP

    12288:zy906RYszDOrW9NDA740J1CUemRbgDi3FU9mFWmaJbB4wylQxXQnzDgo:zy7zyrv740JRgDiVU9APMbBZylCXU

Malware Config

Targets

    • Target

      d535475a00f71bcf55aa10be4a00005b35f8721277b07cd4c73da5c3aaedb349

    • Size

      746KB

    • MD5

      f5196113a822fecf2f0dfaec034700fc

    • SHA1

      f8b869f2f6bdb056dee305c9e0b9a06f4eb9e9fd

    • SHA256

      d535475a00f71bcf55aa10be4a00005b35f8721277b07cd4c73da5c3aaedb349

    • SHA512

      0240a94afe8f36f0f32b27cf82bcd7dbfc9562bb0855b2afbfe6a5cfec525576def9f6b602281e51bd5fb70b792e64231ca77206237c0b0d2a28b981a48e670b

    • SSDEEP

      12288:zy906RYszDOrW9NDA740J1CUemRbgDi3FU9mFWmaJbB4wylQxXQnzDgo:zy7zyrv740JRgDiVU9APMbBZylCXU

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks