General

  • Target

    748018d0b4ac3423e67f7b6264eb62f220401c3fe460e0702093ddb7ede45928

  • Size

    694KB

  • Sample

    230425-wgdf6sca82

  • MD5

    42edca6900f949a1cf61e3f63897b14b

  • SHA1

    1d2a09c29edc5d798be950b59bae58eff42af9a8

  • SHA256

    748018d0b4ac3423e67f7b6264eb62f220401c3fe460e0702093ddb7ede45928

  • SHA512

    fbb5c7b5afd2c741483b7e34b5f7c2c192ee83aa3eb73b05503b863a08ac2915a63a8511ea096afdfadecbe53d9433a33d3f2cc124b2b3f416b67c4ba3518803

  • SSDEEP

    12288:ty90DOastYi0Llq7KugRIqlnifVdUN0cRxbP8tBkOfsHVP:tyXasYLDGql6dUeCb+sH1

Malware Config

Targets

    • Target

      748018d0b4ac3423e67f7b6264eb62f220401c3fe460e0702093ddb7ede45928

    • Size

      694KB

    • MD5

      42edca6900f949a1cf61e3f63897b14b

    • SHA1

      1d2a09c29edc5d798be950b59bae58eff42af9a8

    • SHA256

      748018d0b4ac3423e67f7b6264eb62f220401c3fe460e0702093ddb7ede45928

    • SHA512

      fbb5c7b5afd2c741483b7e34b5f7c2c192ee83aa3eb73b05503b863a08ac2915a63a8511ea096afdfadecbe53d9433a33d3f2cc124b2b3f416b67c4ba3518803

    • SSDEEP

      12288:ty90DOastYi0Llq7KugRIqlnifVdUN0cRxbP8tBkOfsHVP:tyXasYLDGql6dUeCb+sH1

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks