General

  • Target

    48b8d126b248ad586458a97e93d265aa886bab9cf9dbd290f9854782d1812e6a

  • Size

    696KB

  • Sample

    230426-sy6bqsac29

  • MD5

    f6c7c39a5fa47f15d419d7333fa8e430

  • SHA1

    4951675310d368a4b529196d56100aaccde9d604

  • SHA256

    48b8d126b248ad586458a97e93d265aa886bab9cf9dbd290f9854782d1812e6a

  • SHA512

    25c487c7c91c193f6a095e41c0a8f58d8f5199c7aedd2ab5338483c71f81e6b7ed993beb3a47761261d83a367bce7b691ad07df3a9b8e7335199993cb8fe3b7f

  • SSDEEP

    12288:Vy90T/D2lTyX0d5+7zHeZ2P3mUFIEHxBq8dLljHigOsqfLL2G:Vy+/D2li0f+/73mUFhRBq8HT47

Malware Config

Targets

    • Target

      48b8d126b248ad586458a97e93d265aa886bab9cf9dbd290f9854782d1812e6a

    • Size

      696KB

    • MD5

      f6c7c39a5fa47f15d419d7333fa8e430

    • SHA1

      4951675310d368a4b529196d56100aaccde9d604

    • SHA256

      48b8d126b248ad586458a97e93d265aa886bab9cf9dbd290f9854782d1812e6a

    • SHA512

      25c487c7c91c193f6a095e41c0a8f58d8f5199c7aedd2ab5338483c71f81e6b7ed993beb3a47761261d83a367bce7b691ad07df3a9b8e7335199993cb8fe3b7f

    • SSDEEP

      12288:Vy90T/D2lTyX0d5+7zHeZ2P3mUFIEHxBq8dLljHigOsqfLL2G:Vy+/D2li0f+/73mUFhRBq8HT47

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks