meduza | 69c172059f6242ae92efcc418a3eb4fb568f2ce193403194652f6ae962680cfe

Sharing

Copy URL Twitter E-mail

General

Target
ccsetup622.exe
Size 79.5MB
Sample240324-ry5vjadc58
SHA256 69c172059f6242ae92efcc418a3eb4fb568f2ce193403194652f6ae962680cfe
MD5 91cfb3b7488680933f19dea8e4e28a9a
SHA1 b0d1321bebadb6a0177acf3b5eb87da75132f6f7
SHA512 ee7cb20a25e82ba8d703164546622752f667f5c32c31d5c5bb45391718f87d8ce1a9708ee05e4ce000a527a6cd8f220b9527383c4526793c0206a2e23f0ed655
SSDEEP 1572864:C5ftwlU3g4NXgBfXUVFVpHy6PvSbJsDKIeiXuoOudA0HleCI/zSlHTKWj:CtEU1QBfEXbHy+vSbqOjiW0HleCIVWj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ccsetup622.exe
- Size 79.5MB
- SHA256 69c172059f6242ae92efcc418a3eb4fb568f2ce193403194652f6ae962680cfe
- MD5 91cfb3b7488680933f19dea8e4e28a9a
- SHA1 b0d1321bebadb6a0177acf3b5eb87da75132f6f7
- SHA512 ee7cb20a25e82ba8d703164546622752f667f5c32c31d5c5bb45391718f87d8ce1a9708ee05e4ce000a527a6cd8f220b9527383c4526793c0206a2e23f0ed655
- SSDEEP 1572864:C5ftwlU3g4NXgBfXUVFVpHy6PvSbJsDKIeiXuoOudA0HleCI/zSlHTKWj:CtEU1QBfEXbHy+vSbqOjiW0HleCIVWj
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit discovery persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/INetC.dll
- Size 23KB
- SHA256 5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
- MD5 7760daf1b6a7f13f06b25b5a09137ca1
- SHA1 cc5a98ea3aa582de5428c819731e1faeccfcf33a
- SHA512 d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
- SSDEEP 384:l4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO:lG8sUAUnt88CFJDhmajMA
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
- MD5 675c4948e1efc929edcabfe67148eddd
- SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
- SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
- SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $_131_/lang-1025.dll
- Size 245KB
- SHA256 54b632b9b137d4df67b1bb0f618276491ae024cdae374e320142ab17122a82d9
- MD5 44041674b63c764069e91eed2e1f06ed
- SHA1 ee8913298d06e51691bc845abc92b8846ffff2b5
- SHA512 b9bb820b852b65b5e784d36b86f196a64ff1e24ca6d9f4feee78fd801fc59994cd0f49dab8ce9ff1791087af18f475c23444e5f009f956912b478d3f600173d7
- SSDEEP 3072:kOJrjpwJ5WckrG4m4xyOfF38ForEjl34/s2O8sl10sO625VvxX0n+TOq3jK5zeDk:3lLcEs7UIX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  $_131_/lang-1026.dll
- Size 291KB
- SHA256 14e9461d342a1bb148bbf001c1dcc1e205bed75973b1aca95737bd2a2a7eaa5e
- MD5 5fbccc1a0e280c22aeef8821e14581f0
- SHA1 52e1ede05eb2cbf206e438aace2ee33de0a32665
- SHA512 7aabe1087e2119d95dd0b2b64ff15a9b41c1eda38de8d4905673290827ca00c8597844d7d163a40adad88890f970f305292dced358dd5f187473025b865a5261
- SSDEEP 1536:sO1ZiAYLSKbody3HxDeNvZtSffDd6vj0oD9h9U1UJph4PWv7KxJcxc:sODPYLFody3HxyNRtmd6JTmUJph48Q
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  $_131_/lang-1027.dll
- Size 294KB
- SHA256 6cb56ad7204d02c569cfe7656d6f3538bff0ce61db67ce179223375b941cb019
- MD5 6fa3efa4e52c30d6674ac98954231108
- SHA1 b11b2f19591ea4095d810e6abe689a137d35abfb
- SHA512 a9b7e45842e78d59b9c2244dd743822b8144377b5beffd214a0599bb387b2dbcae360ac937e1e78f06a6d71d0204616c8cb5ce9f65d2227fa2e3dd6d8fae9ee3
- SSDEEP 3072:jO7rr3phzbmsC0MUmq3nFvQ2iYHzNbUSlLwRPM36qWFnZY2WZDRRqKspxzhwwt:8bbs0MUmqlNbUSlsqWEDUxzl
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  $_131_/lang-1028.dll
- Size 115KB
- SHA256 cc2eb6071cf5eed525243282ea88d06165520d3fc70a4367f79c5377a4716f92
- MD5 c42941da33a400f427a018eff25325b2
- SHA1 0f42455e6fd8056bd5e204fce1db5bdb7b04b72a
- SHA512 f071513afdd7e4595b1b9ec33f14b8a345b66378672b9b139c782c77250fd02f116f20a93c4a72f1f69b415341f12cdd3760b7b040180056a29e79372eb8a97e
- SSDEEP 1536:PmOH7/b/Ln4ysGJVTObdY4MY4JUjAs/0zEwjHh2EL74KxB:PmOH7D7HV4MY4JzlLHHL8C
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  $_131_/lang-1029.dll
- Size 259KB
- SHA256 c2465ae8a662e9b852530c68b30bf09e1b57203ffd9454ec798d121d2a794e17
- MD5 8187478ad516361155997f0964b42575
- SHA1 d8623707d1c3f3c77a963a8f05ee8136d76ea49e
- SHA512 0da2facb51e0da29950555228a01a7fa592db42e5941594fd59d9d24d503be6f4e5601ec3172510ab276da1f7bbeca2bbdb5ec1be9dbc7f9bbece2fdd8002cf6
- SSDEEP 3072:5OkyV9ws1yxbxrTjEuq+mc4l0V13hcIYq80sJ0wonymZq1Mb2gzsC:KKB13rYO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  $_131_/lang-1030.dll
- Size 255KB
- SHA256 ff64bd343e6847dfe9afe95960ec5b2e640b1e1388661633264762c6692fe6a7
- MD5 51abfddaaeaf45ce488582459648aee2
- SHA1 30021c1e793936ba8eccd7064b979470c75bd154
- SHA512 f345c628ada90ae2650b2c9e56468723e2e3c7980e58f59293fb2234ad5c555ac390492021b631072ee041094e4c3412846934828378f4e644ee2f19150188f7
- SSDEEP 3072:/OqAMUPjdHlysCPH02R/CCzuo8JqT1oS748mSZtlFgCIMgSnQMiG7F:WhlyhPmQpgAiGR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  $_131_/lang-1031.dll
- Size 288KB
- SHA256 d455d6f97609ec4cce604929ace25a45eab7037338a1b4b54ed4a9a4165b2254
- MD5 5f0332cfcb907df41f0a9f2b52ef65ad
- SHA1 c5fd9b23a370a524357a1a31fc136cbd60fdae4d
- SHA512 9013f22681e37bd293c09b8c3debf70a9cbbcb862ca25d69f16ea81eba74858cbefb19c44540f2edc30b571631bf767056afcf37c51e956e567c566c96829128
- SSDEEP 3072:jOfyJRKPgjvypvWTChegDQhK7JUfRtR+ga9hI7AlfbamVXuGdIEhpg8XVLZkwwl9:a6ypmqEFzda9YhozQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  $_131_/lang-1032.dll
- Size 302KB
- SHA256 61e3f7b374f1d6f4a8fb53f3efa5d3247521ac181fa142dfd090cbb3e0a2f06b
- MD5 043d618683e82522d6593d177d326fdb
- SHA1 ae71397f4ffa384e375137bc63670a5c50abec8e
- SHA512 ae8e7d586d143b6cfc18fa551fe7cc3d09a2420666fbbe268d467b52ded5922429abf708328afe24ab024dbe9a9e49986beff4f4a995fdbd884c9f66744cf57c
- SSDEEP 3072:+Oz6kCHTgkU7ZcvMQmOnMGopX6Y85dWORIqC4adqLDBBlKLSUG8ioi9rvxVJzAk3:4vMdy6PynB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  $_131_/lang-1034.dll
- Size 287KB
- SHA256 09c2a9316eb5179c35f883f5dfd87ccc844a31785f963d48229f8328443c6a4e
- MD5 53fe07240400a5c69c38e151a5925564
- SHA1 23713a2f00a370d869680a0b4ba5cd576659bddf
- SHA512 ae39b6ca95c09be06fdb703880d6a913986d8040f74a9983839dc16ddd4dea561a67ce5785fa6611c2f3e6bb96df456aea28b7c95d6dad1ed005cc3c13e8aed5
- SSDEEP 3072:bOaWXaxVncqz574Dc+JqL/wDFyIsDFPXJeiWaC7kkhTrldUuUfHu6KFWhaMV/vdR:xNxVcq9+JqLY4RDFPQivkhQHlhaMFuE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  $_131_/lang-1035.dll
- Size 267KB
- SHA256 9b83e27795502a2e5ad144ef2850e1122c2c364824498c916cc049e08f0fd3ca
- MD5 baf5c5f4735dafbca4dbd0468daf7ccd
- SHA1 25c32cfa05ea3f39e9cce57c773ca11bbe5e30b5
- SHA512 c2b81f954431dfebfcb010b25a7006fc0ac63f5e30b329e937549880d29af61cc3f92deffc637ce9d3d81099126360f271edf2371a24367f5e8f5b9463373930
- SSDEEP 3072:7Oi70AYKzLFQXBRLAEmW6WiM8LHxaMNv0HhZ/m2lki2/eqLyJ801IEaI88RTr+vh:BLFS8zx/exWVhziBZpKY/slYBnK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads user/profile data of web browsers

Downloads MZ/PE file

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32