General

  • Target

    22620887783475107184ef20a540129722ef17873f95cd99852b978dfd2a6d09

  • Size

    241KB

  • Sample

    240407-x2dhcace27

  • MD5

    66f4bc39e87c07681c40d0288ad92145

  • SHA1

    9802081dbed5e172a128b6135afdaf118b1768fc

  • SHA256

    22620887783475107184ef20a540129722ef17873f95cd99852b978dfd2a6d09

  • SHA512

    dc9f4218c0464341982dde6be9a22e592aaced8cb1d98e8a9a71bcf2d7f61b8c707ce2c3bedcc61779a07ff7a2d6fc7221c36aecd10e9da2c0509546c044fdf4

  • SSDEEP

    6144:6jluQoSFIo5R4nM/40yJW4aTfLNAP2Rr7vuZI0lWOsWC6wp7W7SU8:6EQoSvqhKfBuj7WOdW7Wer

Malware Config

Targets

    • Target

      22620887783475107184ef20a540129722ef17873f95cd99852b978dfd2a6d09

    • Size

      241KB

    • MD5

      66f4bc39e87c07681c40d0288ad92145

    • SHA1

      9802081dbed5e172a128b6135afdaf118b1768fc

    • SHA256

      22620887783475107184ef20a540129722ef17873f95cd99852b978dfd2a6d09

    • SHA512

      dc9f4218c0464341982dde6be9a22e592aaced8cb1d98e8a9a71bcf2d7f61b8c707ce2c3bedcc61779a07ff7a2d6fc7221c36aecd10e9da2c0509546c044fdf4

    • SSDEEP

      6144:6jluQoSFIo5R4nM/40yJW4aTfLNAP2Rr7vuZI0lWOsWC6wp7W7SU8:6EQoSvqhKfBuj7WOdW7Wer

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks