General

  • Target

    10b858faebcb6d870e301908f31d7eccdba6d49db8e6b00adb936cb87fb15f7d

  • Size

    694KB

  • Sample

    230425-qxhg6saf52

  • MD5

    396a115783579f92acee0d50b3db982e

  • SHA1

    ec842757b4eb30cca5cda10a839effebd796dcf4

  • SHA256

    10b858faebcb6d870e301908f31d7eccdba6d49db8e6b00adb936cb87fb15f7d

  • SHA512

    f1ef59ef0109b00b75483c5838541e4e7e0148b6cd9d0f41be42c2d81e534e7414af95ada43be9f74e016dfdb11ccdfaa96eb04188d88e20d250d7bb23213c18

  • SSDEEP

    12288:oy90YibYoT8MjfaEH29+P2YoPifsp/AsnzlUsUx5vleu2KXina2Sn4J:oyiQOfaEHWyloKmzlUsUxWKtFn4J

Malware Config

Targets

    • Target

      10b858faebcb6d870e301908f31d7eccdba6d49db8e6b00adb936cb87fb15f7d

    • Size

      694KB

    • MD5

      396a115783579f92acee0d50b3db982e

    • SHA1

      ec842757b4eb30cca5cda10a839effebd796dcf4

    • SHA256

      10b858faebcb6d870e301908f31d7eccdba6d49db8e6b00adb936cb87fb15f7d

    • SHA512

      f1ef59ef0109b00b75483c5838541e4e7e0148b6cd9d0f41be42c2d81e534e7414af95ada43be9f74e016dfdb11ccdfaa96eb04188d88e20d250d7bb23213c18

    • SSDEEP

      12288:oy90YibYoT8MjfaEH29+P2YoPifsp/AsnzlUsUx5vleu2KXina2Sn4J:oyiQOfaEHWyloKmzlUsUxWKtFn4J

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks