General

  • Target

    49378b57053062cc2feeaad1134598e207cf44ff40ba93ee97dc5d176dd419ac

  • Size

    702KB

  • Sample

    230425-gd5nxsae4s

  • MD5

    83705e7d545d2d593108cc12fb8b01c3

  • SHA1

    7d3f132077ac38a0b362bb5ecf93317a7082ce2e

  • SHA256

    49378b57053062cc2feeaad1134598e207cf44ff40ba93ee97dc5d176dd419ac

  • SHA512

    32114bb237e476b732657901114302256e76c770b9c83f4889379e8a5f802a0b39e8c4d48a8aeaa085b55566df262f1b0ef2261bba5ae49d73dfd2804f394b6d

  • SSDEEP

    12288:qy90aleOTFHn9qAdDF8eZYyKkBvBCvr+eyEG2Eo9wZGQVbXAUcFF9nlNzaGw:qynrTFwAd4GBCT+6Gaww4EnFFdldbw

Malware Config

Targets

    • Target

      49378b57053062cc2feeaad1134598e207cf44ff40ba93ee97dc5d176dd419ac

    • Size

      702KB

    • MD5

      83705e7d545d2d593108cc12fb8b01c3

    • SHA1

      7d3f132077ac38a0b362bb5ecf93317a7082ce2e

    • SHA256

      49378b57053062cc2feeaad1134598e207cf44ff40ba93ee97dc5d176dd419ac

    • SHA512

      32114bb237e476b732657901114302256e76c770b9c83f4889379e8a5f802a0b39e8c4d48a8aeaa085b55566df262f1b0ef2261bba5ae49d73dfd2804f394b6d

    • SSDEEP

      12288:qy90aleOTFHn9qAdDF8eZYyKkBvBCvr+eyEG2Eo9wZGQVbXAUcFF9nlNzaGw:qynrTFwAd4GBCT+6Gaww4EnFFdldbw

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks