Resubmissions

20-06-2024 08:48

240620-kqs3fasgrl 10

24-02-2024 08:34

240224-kgll1afd31 10

General

  • Target

    2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2

  • Size

    573KB

  • Sample

    240224-kgll1afd31

  • MD5

    2cda932f5a9dafb0a328d0f9788bd89c

  • SHA1

    e27521c7158c6af3aa58f78fcbed64b17c946f70

  • SHA256

    2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2

  • SHA512

    3bcaf2bda26b22b67edcdd5ca357c8e0b7124788dd905c7bf6cacce080ae3f24bd09e1e9260a3ebf3d4d62ea749f7a8b965193a2ebf6db85a563735874511880

  • SSDEEP

    12288:BV0qnXKTH2P6rxTcQpXDHgswvodgTAdA:BV0EMm6rxTcQjos

Malware Config

Targets

    • Target

      2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2

    • Size

      573KB

    • MD5

      2cda932f5a9dafb0a328d0f9788bd89c

    • SHA1

      e27521c7158c6af3aa58f78fcbed64b17c946f70

    • SHA256

      2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2

    • SHA512

      3bcaf2bda26b22b67edcdd5ca357c8e0b7124788dd905c7bf6cacce080ae3f24bd09e1e9260a3ebf3d4d62ea749f7a8b965193a2ebf6db85a563735874511880

    • SSDEEP

      12288:BV0qnXKTH2P6rxTcQpXDHgswvodgTAdA:BV0EMm6rxTcQjos

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Renames multiple (8527) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks