General

  • Target

    firsttest.exe

  • Size

    1.5MB

  • Sample

    240118-p4bsjaceh5

  • MD5

    8bb338177a68851428cb952cc157ca37

  • SHA1

    da2e10427081f89012a16d72275da0561ee425d8

  • SHA256

    5d9fd19eb2028c1d5433c40286bd724ccaf3b0eda9bd510bef9537e228a47d82

  • SHA512

    37785e7fe0c41e892661fdf4344c82b289f6663d0659f4ca14952101ddc1d561796d7bda3cc4bacce6747063de7c8aecb1cad08f65031bf6a8b218ba8d0b2795

  • SSDEEP

    24576:kEk0OwQ69WHrXz3gDYEzfbQAT5zi9m02NdJW9SUDmsXU7V2pQGTmMp/1q/h8TuD:1YEzfbf9i9m0ws9/msXQ8xt/uD

Malware Config

Targets

    • Target

      firsttest.exe

    • Size

      1.5MB

    • MD5

      8bb338177a68851428cb952cc157ca37

    • SHA1

      da2e10427081f89012a16d72275da0561ee425d8

    • SHA256

      5d9fd19eb2028c1d5433c40286bd724ccaf3b0eda9bd510bef9537e228a47d82

    • SHA512

      37785e7fe0c41e892661fdf4344c82b289f6663d0659f4ca14952101ddc1d561796d7bda3cc4bacce6747063de7c8aecb1cad08f65031bf6a8b218ba8d0b2795

    • SSDEEP

      24576:kEk0OwQ69WHrXz3gDYEzfbQAT5zi9m02NdJW9SUDmsXU7V2pQGTmMp/1q/h8TuD:1YEzfbf9i9m0ws9/msXQ8xt/uD

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks