General

  • Target

    file.exe

  • Size

    274KB

  • Sample

    230528-2mm6fsgg45

  • MD5

    e9eeaf828f5f78576359d41a8906cc87

  • SHA1

    c2aaa842e934c37abf7acb5773153a2b4fc11676

  • SHA256

    7fda535e57d4fb87f4bfb17ed6305f1c9992c0c44341729a5b19c0eafb7e48d9

  • SHA512

    151e940a6a8b8110eb56f44b8ee120f27b679b18be8bbe553a35a9bf16622b4350138d06f10dcdd9e8f3c35a836980640d46d4e5cf6ca39cff026c9b01e00678

  • SSDEEP

    3072:DQIY6FnuBRFdwxI5T+2NzkfNGWRDrr44tcqH5ZBpwilh9nQ:8IY6gR8IZdtuD443oiD6

Malware Config

Targets

    • Target

      file.exe

    • Size

      274KB

    • MD5

      e9eeaf828f5f78576359d41a8906cc87

    • SHA1

      c2aaa842e934c37abf7acb5773153a2b4fc11676

    • SHA256

      7fda535e57d4fb87f4bfb17ed6305f1c9992c0c44341729a5b19c0eafb7e48d9

    • SHA512

      151e940a6a8b8110eb56f44b8ee120f27b679b18be8bbe553a35a9bf16622b4350138d06f10dcdd9e8f3c35a836980640d46d4e5cf6ca39cff026c9b01e00678

    • SSDEEP

      3072:DQIY6FnuBRFdwxI5T+2NzkfNGWRDrr44tcqH5ZBpwilh9nQ:8IY6gR8IZdtuD443oiD6

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks