General

  • Target

    d9f9d75eed17f71ddb5c06264518536631343af2cb431422499537e4337055e5

  • Size

    694KB

  • Sample

    230425-r1l57scf81

  • MD5

    27a051cd951321e0c212497bd2460231

  • SHA1

    a6d89d5897a47b5c90c24df7f21be6a5e85d2ab0

  • SHA256

    d9f9d75eed17f71ddb5c06264518536631343af2cb431422499537e4337055e5

  • SHA512

    f546570b5889014f2195a8d4956fde310306b49b0681b3b00f40d13ef291b6409982b4121871a292664821a1a9ebafb591f4f40be4587bfd3522d0e90d6c26f9

  • SSDEEP

    12288:Uy90YZ0oIu/umSP+gMv2MUaYRIvZiU/AslND8iUA5vleu2KztyMvyx1:UyrT5mv2gMvTUaT5XD8iUcWKZRvyT

Malware Config

Targets

    • Target

      d9f9d75eed17f71ddb5c06264518536631343af2cb431422499537e4337055e5

    • Size

      694KB

    • MD5

      27a051cd951321e0c212497bd2460231

    • SHA1

      a6d89d5897a47b5c90c24df7f21be6a5e85d2ab0

    • SHA256

      d9f9d75eed17f71ddb5c06264518536631343af2cb431422499537e4337055e5

    • SHA512

      f546570b5889014f2195a8d4956fde310306b49b0681b3b00f40d13ef291b6409982b4121871a292664821a1a9ebafb591f4f40be4587bfd3522d0e90d6c26f9

    • SSDEEP

      12288:Uy90YZ0oIu/umSP+gMv2MUaYRIvZiU/AslND8iUA5vleu2KztyMvyx1:UyrT5mv2gMvTUaT5XD8iUcWKZRvyT

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks