General

  • Target

    ImageLoggerV6.exe

  • Size

    74.7MB

  • Sample

    231125-2b5w5adc85

  • MD5

    3c2b9b1d72dcaf55a3780bf5a22daf1f

  • SHA1

    65a6fb9aa2de1a4fd3d94068cd6563cb3c45380a

  • SHA256

    a18d6ee3ef9639e4a5ebbeba5f02ff17abfca6399c2743329b4a067306dfd346

  • SHA512

    5da1a8cc1069c5883267bc1d76f164bdba5644054eac7f7e2fcf196f76f87ac6affd66db2724797d0770352a16f030f85390cc939e7c38f96a7c517b7014ffb9

  • SSDEEP

    1572864:rK2MueQpjvkSk8IpG7V+VPhqSSE7ARjRHlWWpyppiZzI+hR1XWDYiZBkyF+:mZueqrkSkB05awS8Rd0eg2zd7XdiIy+

Malware Config

Targets

    • Target

      ImageLoggerV6.exe

    • Size

      74.7MB

    • MD5

      3c2b9b1d72dcaf55a3780bf5a22daf1f

    • SHA1

      65a6fb9aa2de1a4fd3d94068cd6563cb3c45380a

    • SHA256

      a18d6ee3ef9639e4a5ebbeba5f02ff17abfca6399c2743329b4a067306dfd346

    • SHA512

      5da1a8cc1069c5883267bc1d76f164bdba5644054eac7f7e2fcf196f76f87ac6affd66db2724797d0770352a16f030f85390cc939e7c38f96a7c517b7014ffb9

    • SSDEEP

      1572864:rK2MueQpjvkSk8IpG7V+VPhqSSE7ARjRHlWWpyppiZzI+hR1XWDYiZBkyF+:mZueqrkSkB05awS8Rd0eg2zd7XdiIy+

    • Enumerates VirtualBox DLL files

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks