General

  • Target

    ac922ce39d4d2aaeab1cdc528ef2b7aa.bin

  • Size

    318KB

  • Sample

    231101-cfat4sgh8y

  • MD5

    a2dbc1604b3198023b20660fb4fafc3b

  • SHA1

    b9732458d15c024f762ad743434e37f05341bb34

  • SHA256

    f2b001ae1a248720db292251e2e3049e75ba1f9e0b391f1487962f57ec6f5563

  • SHA512

    27fd71d182b4a771862ec5b9880235e35f0265c8f6c4ec018b908d5deded59997475c13bbf0ec6f545fab4272bb33764c3048c07f9866bf552cf57c8e9c6310c

  • SSDEEP

    6144:nUECUZQFbQrH5LzJe3pyKkkRVLV80clE52U8/QtuDZi1QUdya:YRQtYYeFhB52UjcDYvz

Malware Config

Targets

    • Target

      da4b24ebe1d17357f778a9947a8146fd9d7e88d1f64a65695fb245fbccc4269d.exe

    • Size

      575KB

    • MD5

      ac922ce39d4d2aaeab1cdc528ef2b7aa

    • SHA1

      a8c680465ec93dd06885a85baf84a860c06b11af

    • SHA256

      da4b24ebe1d17357f778a9947a8146fd9d7e88d1f64a65695fb245fbccc4269d

    • SHA512

      495de9b12123dfa0f497fc5bd1ba6b231a707a90b11bb8646909a0b63ba4cd800315e501fbd915a2f68a063f318a78676327436cc04fbfe059e713823d347de9

    • SSDEEP

      12288:MS4vdwKTNWuuRYqrggHp/bLf7daLBIlXSY4j+6qj9:aF7M0UJf7gtIlqjyj9

    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks