General

  • Target

    3664b008e4171305f1a5e66a33886aa45cdf62cead288cc0c2b1d3dd02eb9e26

  • Size

    746KB

  • Sample

    230425-dy5b4saa2z

  • MD5

    6d3de6bf396863243e7a6a7e6cec89f3

  • SHA1

    fed7582ba2399bfc925868c7ab02a8b8f38aea95

  • SHA256

    3664b008e4171305f1a5e66a33886aa45cdf62cead288cc0c2b1d3dd02eb9e26

  • SHA512

    3bf7494cf30587edc06c6d6e0550add34f38a03280eba4463314c8cb086b0b341382873b608b18dfe8d62e7ca8128cb0d15f82054992ea84b165a34a48468e4d

  • SSDEEP

    12288:Ey90GnDTtE/X8xtdfLgJfFKjn9169OJBt5XVJUjNf6SeTUBPI:EylnDTtE0HNgJfYjlR5XbWxhI

Malware Config

Targets

    • Target

      3664b008e4171305f1a5e66a33886aa45cdf62cead288cc0c2b1d3dd02eb9e26

    • Size

      746KB

    • MD5

      6d3de6bf396863243e7a6a7e6cec89f3

    • SHA1

      fed7582ba2399bfc925868c7ab02a8b8f38aea95

    • SHA256

      3664b008e4171305f1a5e66a33886aa45cdf62cead288cc0c2b1d3dd02eb9e26

    • SHA512

      3bf7494cf30587edc06c6d6e0550add34f38a03280eba4463314c8cb086b0b341382873b608b18dfe8d62e7ca8128cb0d15f82054992ea84b165a34a48468e4d

    • SSDEEP

      12288:Ey90GnDTtE/X8xtdfLgJfFKjn9169OJBt5XVJUjNf6SeTUBPI:EylnDTtE0HNgJfYjlR5XbWxhI

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks