General

  • Target

    Loader.exe

  • Size

    6.7MB

  • Sample

    240527-2gel5acd8y

  • MD5

    fec24ccf2b85d85b131ecfc4bdda0746

  • SHA1

    ee5de1e5a89d84d64d3aedb81179659b5d03e6db

  • SHA256

    6d34cf62ae1124e407058500af4fc79a53efd3e4958c9b027c728876c25d1b37

  • SHA512

    1bb71198b66bb28ec4770614de97f51fcd462f2372e57cee4707e2bd5c97efb6862a028507068f6e246375a5386f67e29245ac4282ffa07b3a91675683ee8281

  • SSDEEP

    196608:ShZOFhN3eN/FJMIDJf0gsAGK5SEQRLuAKuzxu:Bq/Fqyf0gsfN6AK

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      6.7MB

    • MD5

      fec24ccf2b85d85b131ecfc4bdda0746

    • SHA1

      ee5de1e5a89d84d64d3aedb81179659b5d03e6db

    • SHA256

      6d34cf62ae1124e407058500af4fc79a53efd3e4958c9b027c728876c25d1b37

    • SHA512

      1bb71198b66bb28ec4770614de97f51fcd462f2372e57cee4707e2bd5c97efb6862a028507068f6e246375a5386f67e29245ac4282ffa07b3a91675683ee8281

    • SSDEEP

      196608:ShZOFhN3eN/FJMIDJf0gsAGK5SEQRLuAKuzxu:Bq/Fqyf0gsfN6AK

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks