General

  • Target

    9a8f0c9355e24850d336d5344d9a790d0b7ac9ca7e5c553601b55891aaa9f293

  • Size

    611KB

  • Sample

    230425-ewcdzsgd55

  • MD5

    afbf06ac24c9114c77589dd6b23ebf7f

  • SHA1

    0be8ff07423db0f83d3026af610e0fcff3a3809c

  • SHA256

    9a8f0c9355e24850d336d5344d9a790d0b7ac9ca7e5c553601b55891aaa9f293

  • SHA512

    c2f16c757d0aa51cfd3da9040f82833b662ad07cf81ebb9992ec11885aef8f5548d2bfd48f7aeadd2c2c273bcfa67c2f198d340ade58af0ac748271014cf6325

  • SSDEEP

    12288:Uy90Kx5QD9SOZlEjmzVxqt9CTvtNXPdB7h5Io:UyFOUjwqmpNXlB7oo

Malware Config

Targets

    • Target

      9a8f0c9355e24850d336d5344d9a790d0b7ac9ca7e5c553601b55891aaa9f293

    • Size

      611KB

    • MD5

      afbf06ac24c9114c77589dd6b23ebf7f

    • SHA1

      0be8ff07423db0f83d3026af610e0fcff3a3809c

    • SHA256

      9a8f0c9355e24850d336d5344d9a790d0b7ac9ca7e5c553601b55891aaa9f293

    • SHA512

      c2f16c757d0aa51cfd3da9040f82833b662ad07cf81ebb9992ec11885aef8f5548d2bfd48f7aeadd2c2c273bcfa67c2f198d340ade58af0ac748271014cf6325

    • SSDEEP

      12288:Uy90Kx5QD9SOZlEjmzVxqt9CTvtNXPdB7h5Io:UyFOUjwqmpNXlB7oo

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks