General

  • Target

    a887008ede82b16be57b9d9a40d80ffcd039591579809a990c2aceea5a8e5892

  • Size

    690KB

  • Sample

    230426-ydqcnsbd98

  • MD5

    b8c3c57df4db6ec57f6c4a3e20f9930b

  • SHA1

    a566c531c6d2642a4c1c6a046ee17a29e8eca11b

  • SHA256

    a887008ede82b16be57b9d9a40d80ffcd039591579809a990c2aceea5a8e5892

  • SHA512

    54193a894adcf989c931ec419b40d11325a82bb9b0f6810c1076514616c1de3c379c51854eead1b88b94868b3e91dd82fdb058b42334cf3297435a72b9e8cac0

  • SSDEEP

    12288:my90ysx8kQbr3+kBV1Z3wE+60gl7kBa6F9+PXtG5niNhmLR+Ou1sM:my28kQjyTAwoNWuF

Malware Config

Targets

    • Target

      a887008ede82b16be57b9d9a40d80ffcd039591579809a990c2aceea5a8e5892

    • Size

      690KB

    • MD5

      b8c3c57df4db6ec57f6c4a3e20f9930b

    • SHA1

      a566c531c6d2642a4c1c6a046ee17a29e8eca11b

    • SHA256

      a887008ede82b16be57b9d9a40d80ffcd039591579809a990c2aceea5a8e5892

    • SHA512

      54193a894adcf989c931ec419b40d11325a82bb9b0f6810c1076514616c1de3c379c51854eead1b88b94868b3e91dd82fdb058b42334cf3297435a72b9e8cac0

    • SSDEEP

      12288:my90ysx8kQbr3+kBV1Z3wE+60gl7kBa6F9+PXtG5niNhmLR+Ou1sM:my28kQjyTAwoNWuF

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks