General

  • Target

    af5ca885386415a7f4d73c32ff76a296cc2bb35b5960c04308f8161134147715

  • Size

    2.2MB

  • Sample

    230616-k1b7nseb39

  • MD5

    beb5308a627b26db7043efb8d67fbeb7

  • SHA1

    f181e7a98fec6ed82cb1a6b01b708a9e416c6093

  • SHA256

    af5ca885386415a7f4d73c32ff76a296cc2bb35b5960c04308f8161134147715

  • SHA512

    6c7c2b6e8a6f6bea41a47a0e00759a30044e0382f4a58837e8d35737ec2cb28436219044e0761586a203827f18edaba98222ee3895f80dd389d2a8a2d10da9c0

  • SSDEEP

    49152:VvdWhCzTRoXxgexMNJxgWSzNSDkN3P/fVwwUAIop6C:WCzT2XtNWESDkf/fV/6C

Malware Config

Targets

    • Target

      af5ca885386415a7f4d73c32ff76a296cc2bb35b5960c04308f8161134147715

    • Size

      2.2MB

    • MD5

      beb5308a627b26db7043efb8d67fbeb7

    • SHA1

      f181e7a98fec6ed82cb1a6b01b708a9e416c6093

    • SHA256

      af5ca885386415a7f4d73c32ff76a296cc2bb35b5960c04308f8161134147715

    • SHA512

      6c7c2b6e8a6f6bea41a47a0e00759a30044e0382f4a58837e8d35737ec2cb28436219044e0761586a203827f18edaba98222ee3895f80dd389d2a8a2d10da9c0

    • SSDEEP

      49152:VvdWhCzTRoXxgexMNJxgWSzNSDkN3P/fVwwUAIop6C:WCzT2XtNWESDkf/fV/6C

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Credential Access

Credentials in Files

1
T1081

Discovery

Remote System Discovery

1
T1018

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Tasks