General

  • Target

    288956072ac1151694a29d17921c271d

  • Size

    87KB

  • Sample

    231225-snar3sfbcl

  • MD5

    288956072ac1151694a29d17921c271d

  • SHA1

    b96c16eaea75ef22a1c71b29ddbcdf23b1343ce3

  • SHA256

    8f8fc246c05c6acc8b22f29bc08b2e09104a048317a4b2e71f69bbbfc4e00d14

  • SHA512

    3f7befe9332c93996226537f825aa93d51b08198c9a84c896895a365fec3a4972824ca79ef09b293cb3437229d286fea49c8652ff85ecbca611c6f61f9b9a968

  • SSDEEP

    1536:GLv1GdXALyIioUrqU9d3QrlQKEdebpHlRomsTTyLMsbXslOQCPt:KOAeLoszWQYbNlams/QvbXEOLPt

Malware Config

Targets

    • Target

      288956072ac1151694a29d17921c271d

    • Size

      87KB

    • MD5

      288956072ac1151694a29d17921c271d

    • SHA1

      b96c16eaea75ef22a1c71b29ddbcdf23b1343ce3

    • SHA256

      8f8fc246c05c6acc8b22f29bc08b2e09104a048317a4b2e71f69bbbfc4e00d14

    • SHA512

      3f7befe9332c93996226537f825aa93d51b08198c9a84c896895a365fec3a4972824ca79ef09b293cb3437229d286fea49c8652ff85ecbca611c6f61f9b9a968

    • SSDEEP

      1536:GLv1GdXALyIioUrqU9d3QrlQKEdebpHlRomsTTyLMsbXslOQCPt:KOAeLoszWQYbNlams/QvbXEOLPt

    • Modifies WinLogon for persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks