General

  • Target

    2dcf982415010a9a93dd8919326258daf5865ad248de1e13cff81e2b1a22aa55

  • Size

    406KB

  • Sample

    240407-yhc8xacg2t

  • MD5

    078aba95aa7a5f290cef84ed464f3577

  • SHA1

    64bbc09de5c653d4a7e27fa5099cd94ebd4d3c48

  • SHA256

    2dcf982415010a9a93dd8919326258daf5865ad248de1e13cff81e2b1a22aa55

  • SHA512

    07d786712326897bbf1ce17e0b0807a79bf801fc5052f390e0f434a2d9c1868004b8318e78a0d680f1eb5c0aa9249d9706fd08da5aace7c55ef618df9ee86e7c

  • SSDEEP

    12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

Malware Config

Targets

    • Target

      2dcf982415010a9a93dd8919326258daf5865ad248de1e13cff81e2b1a22aa55

    • Size

      406KB

    • MD5

      078aba95aa7a5f290cef84ed464f3577

    • SHA1

      64bbc09de5c653d4a7e27fa5099cd94ebd4d3c48

    • SHA256

      2dcf982415010a9a93dd8919326258daf5865ad248de1e13cff81e2b1a22aa55

    • SHA512

      07d786712326897bbf1ce17e0b0807a79bf801fc5052f390e0f434a2d9c1868004b8318e78a0d680f1eb5c0aa9249d9706fd08da5aace7c55ef618df9ee86e7c

    • SSDEEP

      12288:vdDU6g13sJd1fm/+yb3O2jg82ydU/DdKumy:vdE3sJd1fm/+yb3OYg84/JHJ

    • Detects executables containing base64 encoded User Agent

    • UPX dump on OEP (original entry point)

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks