General

  • Target

    d24c54e7e55487c61abbfbe40a60b25d0e9a25518d692cecfe4daf1b324b24c0

  • Size

    1.0MB

  • Sample

    230425-ggz8lsae41

  • MD5

    ea3d4e83fb899ce88ea497d085319bb7

  • SHA1

    792a8d77b90943b06d03d13c6c28a56087156615

  • SHA256

    d24c54e7e55487c61abbfbe40a60b25d0e9a25518d692cecfe4daf1b324b24c0

  • SHA512

    34423c46d3f1b54495fe7316ee350249abbda8d750e450ccb88514a758c1cbdc0cc73a0637c607d302406ebb73452c2a0d81427ce2fd7aaad2990914acdd3afb

  • SSDEEP

    24576:Zqw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:j0Obw4Yt6OQlimjV3tSvc

Malware Config

Targets

    • Target

      d24c54e7e55487c61abbfbe40a60b25d0e9a25518d692cecfe4daf1b324b24c0

    • Size

      1.0MB

    • MD5

      ea3d4e83fb899ce88ea497d085319bb7

    • SHA1

      792a8d77b90943b06d03d13c6c28a56087156615

    • SHA256

      d24c54e7e55487c61abbfbe40a60b25d0e9a25518d692cecfe4daf1b324b24c0

    • SHA512

      34423c46d3f1b54495fe7316ee350249abbda8d750e450ccb88514a758c1cbdc0cc73a0637c607d302406ebb73452c2a0d81427ce2fd7aaad2990914acdd3afb

    • SSDEEP

      24576:Zqw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:j0Obw4Yt6OQlimjV3tSvc

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks