General

  • Target

    12a68c94b4f0b13cca2a8b908bf674686a0ab331ec366d88baa2c192c33f236f.exe

  • Size

    10.5MB

  • Sample

    240517-pbxvasgg68

  • MD5

    f9656fc3a1e0374f728a844a3a97a56a

  • SHA1

    92558a564f524dde5227cb4e463e887a028b465e

  • SHA256

    12a68c94b4f0b13cca2a8b908bf674686a0ab331ec366d88baa2c192c33f236f

  • SHA512

    d2f87396f900b22a9f758d967082a546d177064bbae84c43747eabeb8d51da7ed39c13e38a98f090071ffe7a4d764969682489df03ffc08eb132e53856b50fed

  • SSDEEP

    98304:Bfy32pGWBVD5g/O3VelEaQE4QUzLo47ssIktninGeiUAfFOOKVq/wi:9dGW7d5aQE4DoI0ktninKLn

Malware Config

Targets

    • Target

      12a68c94b4f0b13cca2a8b908bf674686a0ab331ec366d88baa2c192c33f236f.exe

    • Size

      10.5MB

    • MD5

      f9656fc3a1e0374f728a844a3a97a56a

    • SHA1

      92558a564f524dde5227cb4e463e887a028b465e

    • SHA256

      12a68c94b4f0b13cca2a8b908bf674686a0ab331ec366d88baa2c192c33f236f

    • SHA512

      d2f87396f900b22a9f758d967082a546d177064bbae84c43747eabeb8d51da7ed39c13e38a98f090071ffe7a4d764969682489df03ffc08eb132e53856b50fed

    • SSDEEP

      98304:Bfy32pGWBVD5g/O3VelEaQE4QUzLo47ssIktninGeiUAfFOOKVq/wi:9dGW7d5aQE4DoI0ktninKLn

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks