General

  • Target

    4705fe09fae61fc920d384357dac4329.exe

  • Size

    575KB

  • Sample

    231030-qv8atadb8v

  • MD5

    4705fe09fae61fc920d384357dac4329

  • SHA1

    24b1af2ec16fd310de21bce230d500e693f4652c

  • SHA256

    a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b

  • SHA512

    9cacb7f865151110681e240f37fa15931036c21dd041a560d9ed7f7a397ace4127d7c39dcfb15808b12d8a6bb576120585b102b40629d4b373cd3dda8cafc981

  • SSDEEP

    12288:MS4vdwKTNWuuRYqrggHp/bLf7daLBIlXSY4j+6qj9:aF7M0UJf7gtIlqjyj9

Malware Config

Targets

    • Target

      4705fe09fae61fc920d384357dac4329.exe

    • Size

      575KB

    • MD5

      4705fe09fae61fc920d384357dac4329

    • SHA1

      24b1af2ec16fd310de21bce230d500e693f4652c

    • SHA256

      a3a0ec083b5e4e00485974ad2885f89d602a4ea74059b0c5cee54d11f7e3ad7b

    • SHA512

      9cacb7f865151110681e240f37fa15931036c21dd041a560d9ed7f7a397ace4127d7c39dcfb15808b12d8a6bb576120585b102b40629d4b373cd3dda8cafc981

    • SSDEEP

      12288:MS4vdwKTNWuuRYqrggHp/bLf7daLBIlXSY4j+6qj9:aF7M0UJf7gtIlqjyj9

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks