General

  • Target

    NEAS.e2b216127fc9794c4f6c67df7fadbb30_JC.exe

  • Size

    1.0MB

  • Sample

    231102-s8rakagc56

  • MD5

    e2b216127fc9794c4f6c67df7fadbb30

  • SHA1

    0ab55f4032f2eeb5bc3d7ada163b1bf20f65448c

  • SHA256

    2a355098b2e1f49feeece38324438de13ab93c192b649e06a4609fab55cf52b8

  • SHA512

    bf18dca4bcfe7377cae2751dd497e1d93d162d2371c08d1e9de9d1aa7abb42633c1bad25f1fde18f96934d26d9a38a7e0aa7ed0ddb3097476cf2152b960b3670

  • SSDEEP

    24576:t2LvF4Chozk/qBS8enXfbRnKGHzdF8SXraA:QLiC6zkzdnKGHzdF8FA

Malware Config

Targets

    • Target

      NEAS.e2b216127fc9794c4f6c67df7fadbb30_JC.exe

    • Size

      1.0MB

    • MD5

      e2b216127fc9794c4f6c67df7fadbb30

    • SHA1

      0ab55f4032f2eeb5bc3d7ada163b1bf20f65448c

    • SHA256

      2a355098b2e1f49feeece38324438de13ab93c192b649e06a4609fab55cf52b8

    • SHA512

      bf18dca4bcfe7377cae2751dd497e1d93d162d2371c08d1e9de9d1aa7abb42633c1bad25f1fde18f96934d26d9a38a7e0aa7ed0ddb3097476cf2152b960b3670

    • SSDEEP

      24576:t2LvF4Chozk/qBS8enXfbRnKGHzdF8SXraA:QLiC6zkzdnKGHzdF8FA

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks