General

  • Target

    ce2b5bf4c15c9d3e6d8edfce46092334098e5e049557568ec57b67f1d7254104

  • Size

    695KB

  • Sample

    230425-qpbpnacd4z

  • MD5

    46c26744d29d813baba24c09563ce5f2

  • SHA1

    85881cd38370ef70550871c49b8f349f65df2160

  • SHA256

    ce2b5bf4c15c9d3e6d8edfce46092334098e5e049557568ec57b67f1d7254104

  • SHA512

    10b0151319f04e093530b4359cbac15f7a6ad02ea3f205f90213932f2058397207f6d8f695e7544bc8966d813728f3eb44df2608152d9eaf50a1a4087118aa68

  • SSDEEP

    12288:Zy90F4Gl3trfPUs7f9jS6/iTQtvSa3APfBE+U25vleu2K0TV9byImMheX:ZyMH3trf8Y9jEcA3BE+USWKUV9byjjX

Malware Config

Targets

    • Target

      ce2b5bf4c15c9d3e6d8edfce46092334098e5e049557568ec57b67f1d7254104

    • Size

      695KB

    • MD5

      46c26744d29d813baba24c09563ce5f2

    • SHA1

      85881cd38370ef70550871c49b8f349f65df2160

    • SHA256

      ce2b5bf4c15c9d3e6d8edfce46092334098e5e049557568ec57b67f1d7254104

    • SHA512

      10b0151319f04e093530b4359cbac15f7a6ad02ea3f205f90213932f2058397207f6d8f695e7544bc8966d813728f3eb44df2608152d9eaf50a1a4087118aa68

    • SSDEEP

      12288:Zy90F4Gl3trfPUs7f9jS6/iTQtvSa3APfBE+U25vleu2K0TV9byImMheX:ZyMH3trf8Y9jEcA3BE+USWKUV9byjjX

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks