General

  • Target

    77cfdeb83e50db23aeb08e9d60fa37fa17f8ebce2afaaf4aaab472193b88b289.exe.compressed

  • Size

    160KB

  • Sample

    240128-3pe4asdbg9

  • MD5

    22770b109126c42e44ae255b9f603e3c

  • SHA1

    40733c6b3d0fbe2807c4bc7bd68cec141ad7bd62

  • SHA256

    c39ef1bd0b2caa3bb4b7978d799dec6662acd09fc53471fede167e020dd69c9c

  • SHA512

    634f904cd86125e5bd21997bed2d4107ad64f1e4c8605fa54cb8eb5bf9fad4c8177c4ea8263518b32a06e198aa77d873d8add303b1d003f0b4b7c3c095c496de

  • SSDEEP

    3072:NFB3O3IRORghwODMJlz1dxoOXwupfOl2AGZ30r/F4RO+XRsd9Oeg:/BZcIDqvysbpf+2DEN4WU

Malware Config

Targets

    • Target

      77cfdeb83e50db23aeb08e9d60fa37fa17f8ebce2afaaf4aaab472193b88b289.exe.compressed

    • Size

      160KB

    • MD5

      22770b109126c42e44ae255b9f603e3c

    • SHA1

      40733c6b3d0fbe2807c4bc7bd68cec141ad7bd62

    • SHA256

      c39ef1bd0b2caa3bb4b7978d799dec6662acd09fc53471fede167e020dd69c9c

    • SHA512

      634f904cd86125e5bd21997bed2d4107ad64f1e4c8605fa54cb8eb5bf9fad4c8177c4ea8263518b32a06e198aa77d873d8add303b1d003f0b4b7c3c095c496de

    • SSDEEP

      3072:NFB3O3IRORghwODMJlz1dxoOXwupfOl2AGZ30r/F4RO+XRsd9Oeg:/BZcIDqvysbpf+2DEN4WU

    • Detects command variations typically used by ransomware

    • UPX dump on OEP (original entry point)

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks