General

  • Target

    6b7eb72e84e4390ab3b6d2a67a395f2bf292576c5b003637345584ed95e7bda9

  • Size

    480KB

  • Sample

    230505-y4lgeaef2z

  • MD5

    0b118d8eeecbdcdcc1449d2d80a0b68b

  • SHA1

    a54512f4428b968c27c1e8e63f7d93a9452de8c1

  • SHA256

    6b7eb72e84e4390ab3b6d2a67a395f2bf292576c5b003637345584ed95e7bda9

  • SHA512

    2983cce6ade12ccb07cc481a4e0378784883cb3088501abd9d1fd42264094607bbe88dccca621fbae619ff1ddbca135470f0a517e02b1da6d4416222c487272f

  • SSDEEP

    12288:0MrAy90l4M8VEt74vX7loWUZxb1H+grBOKCsqCCG:Uy68VEi7WW6pH+omBCCG

Malware Config

Targets

    • Target

      6b7eb72e84e4390ab3b6d2a67a395f2bf292576c5b003637345584ed95e7bda9

    • Size

      480KB

    • MD5

      0b118d8eeecbdcdcc1449d2d80a0b68b

    • SHA1

      a54512f4428b968c27c1e8e63f7d93a9452de8c1

    • SHA256

      6b7eb72e84e4390ab3b6d2a67a395f2bf292576c5b003637345584ed95e7bda9

    • SHA512

      2983cce6ade12ccb07cc481a4e0378784883cb3088501abd9d1fd42264094607bbe88dccca621fbae619ff1ddbca135470f0a517e02b1da6d4416222c487272f

    • SSDEEP

      12288:0MrAy90l4M8VEt74vX7loWUZxb1H+grBOKCsqCCG:Uy68VEi7WW6pH+omBCCG

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks