General

  • Target

    cfec7c94c7f87c5f81e0983479fbe25a.exe

  • Size

    642KB

  • Sample

    231030-fx413abb4v

  • MD5

    cfec7c94c7f87c5f81e0983479fbe25a

  • SHA1

    ef0df11adc7d36818e95df385dee4d9ad91ff3c4

  • SHA256

    f564bfbcefef157a49b03dd3dce7844cdc2568500c655313a193520e29452512

  • SHA512

    14c73277c103152286eeb215e3b351bf5fb15803a0859400da0287c3286b974624eaeb92d87b2ba93c92bfa226d2fdf86567b888ba0d6a4de26f9952c4b8ae8a

  • SSDEEP

    12288:JHQ4R78rGcukgmWRjAeQ6qtoCldl4Dol9:1HhZcw95j1CloDg9

Malware Config

Targets

    • Target

      cfec7c94c7f87c5f81e0983479fbe25a.exe

    • Size

      642KB

    • MD5

      cfec7c94c7f87c5f81e0983479fbe25a

    • SHA1

      ef0df11adc7d36818e95df385dee4d9ad91ff3c4

    • SHA256

      f564bfbcefef157a49b03dd3dce7844cdc2568500c655313a193520e29452512

    • SHA512

      14c73277c103152286eeb215e3b351bf5fb15803a0859400da0287c3286b974624eaeb92d87b2ba93c92bfa226d2fdf86567b888ba0d6a4de26f9952c4b8ae8a

    • SSDEEP

      12288:JHQ4R78rGcukgmWRjAeQ6qtoCldl4Dol9:1HhZcw95j1CloDg9

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks