General

  • Target

    8afbb85ddeb25335b82292457932e1368527255c4e2bfef32ec55f25eff7d586

  • Size

    694KB

  • Sample

    230426-l7pxsaae5v

  • MD5

    99ab601ca051f854ef8e1181c93ecddd

  • SHA1

    19c8050ee3d483931a3a38e8a6f2bf771689f683

  • SHA256

    8afbb85ddeb25335b82292457932e1368527255c4e2bfef32ec55f25eff7d586

  • SHA512

    ca26b98ea0f9766216e94a4558d0b6025d8fd14a49443e76833f95e738501da14425b71f62fd36bff379134680326624a6b2b59b5c8189db991736c40fc4519a

  • SSDEEP

    12288:wy90Ho33h2Zv0L7ReGc63mbd1sU/fqiK1gmAQ4ZRhuxHv0iD/e7Zk9g9Fd+:wyv33wZc7RT3mZ1sV+mATjec8e7Zka7U

Malware Config

Targets

    • Target

      8afbb85ddeb25335b82292457932e1368527255c4e2bfef32ec55f25eff7d586

    • Size

      694KB

    • MD5

      99ab601ca051f854ef8e1181c93ecddd

    • SHA1

      19c8050ee3d483931a3a38e8a6f2bf771689f683

    • SHA256

      8afbb85ddeb25335b82292457932e1368527255c4e2bfef32ec55f25eff7d586

    • SHA512

      ca26b98ea0f9766216e94a4558d0b6025d8fd14a49443e76833f95e738501da14425b71f62fd36bff379134680326624a6b2b59b5c8189db991736c40fc4519a

    • SSDEEP

      12288:wy90Ho33h2Zv0L7ReGc63mbd1sU/fqiK1gmAQ4ZRhuxHv0iD/e7Zk9g9Fd+:wyv33wZc7RT3mZ1sV+mATjec8e7Zka7U

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks