General

  • Target

    d683c221f1609036795b7d0e8feda8e77d6bc9b6fa16133ff02c104f3d947243

  • Size

    747KB

  • Sample

    230425-bwk5cahe5w

  • MD5

    fb8343c5f4c019f0a1f6737ccf275c8d

  • SHA1

    4ac7e3cbb24dd8943185145f5ab63f2771ec0eb8

  • SHA256

    d683c221f1609036795b7d0e8feda8e77d6bc9b6fa16133ff02c104f3d947243

  • SHA512

    b54ee8a4c494355590a72420c6b6fd168adf808e2a7279dd1361dc600d9f4c0de2767478a6d724ea56f806c4033a140225f54b870f3b7763054d8cd6fe4412d5

  • SSDEEP

    12288:fy90QYDhFBBKIz/LlYn8OnCe0X/Z1easbQWVUJlO4FNP7RdFK68N+H/0:fynYDhFBNzBY8OH0DqhVSNNPldFgz

Malware Config

Targets

    • Target

      d683c221f1609036795b7d0e8feda8e77d6bc9b6fa16133ff02c104f3d947243

    • Size

      747KB

    • MD5

      fb8343c5f4c019f0a1f6737ccf275c8d

    • SHA1

      4ac7e3cbb24dd8943185145f5ab63f2771ec0eb8

    • SHA256

      d683c221f1609036795b7d0e8feda8e77d6bc9b6fa16133ff02c104f3d947243

    • SHA512

      b54ee8a4c494355590a72420c6b6fd168adf808e2a7279dd1361dc600d9f4c0de2767478a6d724ea56f806c4033a140225f54b870f3b7763054d8cd6fe4412d5

    • SSDEEP

      12288:fy90QYDhFBBKIz/LlYn8OnCe0X/Z1easbQWVUJlO4FNP7RdFK68N+H/0:fynYDhFBNzBY8OH0DqhVSNNPldFgz

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks