General

  • Target

    362897ebc826aeee8e260644cc07f47fe925dec9d3f713b2247d22747139ba11

  • Size

    1.5MB

  • Sample

    240407-yr9ngada9v

  • MD5

    87c62771dd8feb030b043d50c4f1d71a

  • SHA1

    942cc3af6edd005e0d47acc281ab22d45b679ee9

  • SHA256

    362897ebc826aeee8e260644cc07f47fe925dec9d3f713b2247d22747139ba11

  • SHA512

    91b4562462fed1b572cc65f33661b94164a4ea667ad7bcfa498a34a801f10b1830168d0ef9ce05687847d01c7df58d49c36ff4fe1a0c45020eca77be0f5511de

  • SSDEEP

    49152:QIeH+ns7pqiSEqZ8pixgs/VsaR4DR10ipv:QjH+sTKKIgCgDR1p

Malware Config

Targets

    • Target

      362897ebc826aeee8e260644cc07f47fe925dec9d3f713b2247d22747139ba11

    • Size

      1.5MB

    • MD5

      87c62771dd8feb030b043d50c4f1d71a

    • SHA1

      942cc3af6edd005e0d47acc281ab22d45b679ee9

    • SHA256

      362897ebc826aeee8e260644cc07f47fe925dec9d3f713b2247d22747139ba11

    • SHA512

      91b4562462fed1b572cc65f33661b94164a4ea667ad7bcfa498a34a801f10b1830168d0ef9ce05687847d01c7df58d49c36ff4fe1a0c45020eca77be0f5511de

    • SSDEEP

      49152:QIeH+ns7pqiSEqZ8pixgs/VsaR4DR10ipv:QjH+sTKKIgCgDR1p

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks