General

  • Target

    9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567

  • Size

    288KB

  • Sample

    240407-3z5fyaad41

  • MD5

    99026ba95db7aea610f0a4942dcce5be

  • SHA1

    f76d366e366010573683293139dc7269a2391a45

  • SHA256

    9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567

  • SHA512

    abc1e263ff2523f26f8f8da78f2b0ec33a926f3834ed69512d8a6d7e676e58e16325e435f03f8cd0b3a4115eb7b0bac915de31320bf1c995801cbe7b44a0a33e

  • SSDEEP

    6144:SjluQoSKIo5Rv4wAXK2CzFH1l4xYRLVAG9E4L:SEQoSeTVAwZH4KRpd9E4L

Malware Config

Targets

    • Target

      9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567

    • Size

      288KB

    • MD5

      99026ba95db7aea610f0a4942dcce5be

    • SHA1

      f76d366e366010573683293139dc7269a2391a45

    • SHA256

      9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567

    • SHA512

      abc1e263ff2523f26f8f8da78f2b0ec33a926f3834ed69512d8a6d7e676e58e16325e435f03f8cd0b3a4115eb7b0bac915de31320bf1c995801cbe7b44a0a33e

    • SSDEEP

      6144:SjluQoSKIo5Rv4wAXK2CzFH1l4xYRLVAG9E4L:SEQoSeTVAwZH4KRpd9E4L

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks