General

  • Target

    b33f9e06836282352f3ba62011341e0f8301b669c7bbedb379adaa385c22f96d

  • Size

    109KB

  • Sample

    240507-as4xlsac2y

  • MD5

    4f42f06755eea2f2b3dff802102fb874

  • SHA1

    36f0c0d9d2f27728986963fd5af11b3dd5ca97ff

  • SHA256

    b33f9e06836282352f3ba62011341e0f8301b669c7bbedb379adaa385c22f96d

  • SHA512

    e14b94f21a5adaeb138a02d32030edf60d3615a33542a1ab4579aece74d1f83c6b109806020b440be51d1ee7bde81615c832d1c4eb1bc639f3079ab8ffdaf0e1

  • SSDEEP

    1536:TRiAXaKD5grAhdVA2VukXKzMf3liaL+SWzR+fy1ZZosMiZ7RtEsH:liAXaKDLVaroj6SWzosZGyRtEs

Malware Config

Targets

    • Target

      b33f9e06836282352f3ba62011341e0f8301b669c7bbedb379adaa385c22f96d

    • Size

      109KB

    • MD5

      4f42f06755eea2f2b3dff802102fb874

    • SHA1

      36f0c0d9d2f27728986963fd5af11b3dd5ca97ff

    • SHA256

      b33f9e06836282352f3ba62011341e0f8301b669c7bbedb379adaa385c22f96d

    • SHA512

      e14b94f21a5adaeb138a02d32030edf60d3615a33542a1ab4579aece74d1f83c6b109806020b440be51d1ee7bde81615c832d1c4eb1bc639f3079ab8ffdaf0e1

    • SSDEEP

      1536:TRiAXaKD5grAhdVA2VukXKzMf3liaL+SWzR+fy1ZZosMiZ7RtEsH:liAXaKDLVaroj6SWzosZGyRtEs

    • Detects executables containing base64 encoded User Agent

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks