General

  • Target

    eefe15abd8f9fcbd991d3e3c3fcf89d615a957ebaa2afb41b99e63a7432189e9

  • Size

    239KB

  • Sample

    240406-ey932aad6s

  • MD5

    39ffab8b08ccdfba483b5c7b50444729

  • SHA1

    e737a48d34c30964a9baca338112e0eb369caec3

  • SHA256

    eefe15abd8f9fcbd991d3e3c3fcf89d615a957ebaa2afb41b99e63a7432189e9

  • SHA512

    cf44709a3407f2c76048be7b09ea65416405910fe83a6c95f3a68140294ba450385754542a983aa2e88b74dc7554475a3110d30dc6037d99dd58c4edeb49d2f6

  • SSDEEP

    1536:Iq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9bc:Iq5ud9qHFO8Kf3rIIbc

Malware Config

Targets

    • Target

      eefe15abd8f9fcbd991d3e3c3fcf89d615a957ebaa2afb41b99e63a7432189e9

    • Size

      239KB

    • MD5

      39ffab8b08ccdfba483b5c7b50444729

    • SHA1

      e737a48d34c30964a9baca338112e0eb369caec3

    • SHA256

      eefe15abd8f9fcbd991d3e3c3fcf89d615a957ebaa2afb41b99e63a7432189e9

    • SHA512

      cf44709a3407f2c76048be7b09ea65416405910fe83a6c95f3a68140294ba450385754542a983aa2e88b74dc7554475a3110d30dc6037d99dd58c4edeb49d2f6

    • SSDEEP

      1536:Iq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9bc:Iq5ud9qHFO8Kf3rIIbc

    • UPX dump on OEP (original entry point)

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks