General

  • Target

    37eea345f24610d7686e7a2798653558e76de91fe36286bea86a011a4ef82bf9

  • Size

    1.1MB

  • Sample

    230425-rjl4waag63

  • MD5

    3589283db2854b448d129231afecd16b

  • SHA1

    d43d479fe48ba564c9f8676440e437c95677cdc8

  • SHA256

    37eea345f24610d7686e7a2798653558e76de91fe36286bea86a011a4ef82bf9

  • SHA512

    62003085272ea6b78ed59fdaa084ebda59913bd54a4ac997871af48cb4fc29db1bc26253b813357e88b8dafc7e7cf13021128beb29a612f73bac4dce3fb10118

  • SSDEEP

    24576:Yy+QLn1cX+d/eTD1rUWMIbpN3p83Dc0/2KayUHWK/yO:f+QLn1cXYmTDOWBNN3u35/2KayUra

Malware Config

Targets

    • Target

      37eea345f24610d7686e7a2798653558e76de91fe36286bea86a011a4ef82bf9

    • Size

      1.1MB

    • MD5

      3589283db2854b448d129231afecd16b

    • SHA1

      d43d479fe48ba564c9f8676440e437c95677cdc8

    • SHA256

      37eea345f24610d7686e7a2798653558e76de91fe36286bea86a011a4ef82bf9

    • SHA512

      62003085272ea6b78ed59fdaa084ebda59913bd54a4ac997871af48cb4fc29db1bc26253b813357e88b8dafc7e7cf13021128beb29a612f73bac4dce3fb10118

    • SSDEEP

      24576:Yy+QLn1cX+d/eTD1rUWMIbpN3p83Dc0/2KayUHWK/yO:f+QLn1cXYmTDOWBNN3u35/2KayUra

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks