General

  • Target

    2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b

  • Size

    1.5MB

  • Sample

    240407-x3m36sce62

  • MD5

    bb6f3565fda7bf286ff05635b968f604

  • SHA1

    2ad2b3dcec719de014c1c301ce5cb686dea21969

  • SHA256

    2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b

  • SHA512

    82601b58f1e1f3c275f3071dc51d1dae65f53b8523cd130feb0ebbfc0538c48c5ae3a6c50cb5d3c7977d2b6c8e43cbc2a9fc0abbf0c8e81846ff46cdf7bd2faf

  • SSDEEP

    24576:V+ejq24CVAHTgRpfkuigAIN4CIipZ7Jwwk6Nmf5NWDNWyIJpNpE0KHWai:Mtq5RpfQG9IijiwkPNGLIJpNuHWj

Malware Config

Targets

    • Target

      2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b

    • Size

      1.5MB

    • MD5

      bb6f3565fda7bf286ff05635b968f604

    • SHA1

      2ad2b3dcec719de014c1c301ce5cb686dea21969

    • SHA256

      2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b

    • SHA512

      82601b58f1e1f3c275f3071dc51d1dae65f53b8523cd130feb0ebbfc0538c48c5ae3a6c50cb5d3c7977d2b6c8e43cbc2a9fc0abbf0c8e81846ff46cdf7bd2faf

    • SSDEEP

      24576:V+ejq24CVAHTgRpfkuigAIN4CIipZ7Jwwk6Nmf5NWDNWyIJpNpE0KHWai:Mtq5RpfQG9IijiwkPNGLIJpNuHWj

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks