General

  • Target

    68a7a77e1e9a004bc9e823d16c808a3129b17d3600a6fc13f0d34f94f4b0c22a.rar

  • Size

    5.6MB

  • Sample

    240613-brbecasfjn

  • MD5

    49ba2dc32416a7c1ce483f54641fd2ee

  • SHA1

    8da37b42b4d6371631e88ed9fa35578d229c7b62

  • SHA256

    68a7a77e1e9a004bc9e823d16c808a3129b17d3600a6fc13f0d34f94f4b0c22a

  • SHA512

    00a0ca994f7e8fff124f70d7cb9cbea06802c874b3411ef397f108461647ee3a1ae7329da81a5c47ffaba3ae871b1118b66a9bbfd92a87d5c98c5fdb7d2c6289

  • SSDEEP

    98304:S6kCT2LuFfjpitn6kCT2LuFsjpitMLyODkR37+jdmwxjTXUrWNLkpyKT7tf4:Rk7aF9k7aFSLyODkt6gwlTECNLrKVQ

Malware Config

Targets

    • Target

      ExtractAll/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk

    • Size

      2KB

    • MD5

      56cc3193b2289919b689f837baeb6e6c

    • SHA1

      d50854ba733fda66cf8ce29f60312ee10c1dca89

    • SHA256

      adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081

    • SHA512

      37891494577ac912291f7af92d625b4a8399137f95134506686ac3a116e4f0289d13ecb04b0d14cecc8a239f0238776780eaee1609d24ff5cffe63bbe8468e01

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Target

      ExtractAll/MyCover3.jpeg

    • Size

      925KB

    • MD5

      0adb9b817f1df7807576c2d7068dd931

    • SHA1

      4a1b94a9a5113106f40cd8ea724703734d15f118

    • SHA256

      98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

    • SHA512

      883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

    • SSDEEP

      24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK

    Score
    3/10
    • Target

      ExtractAll/MyCover4.jpg

    • Size

      83KB

    • MD5

      2bca0eb97a7c0825910517162251471c

    • SHA1

      52d878223c596cb2f130514125e427f6f87d686b

    • SHA256

      fa7b80f3d060c663691f7ede61847d7e1514145e569732af173f61e55ff6e72b

    • SHA512

      c2a5c544ac5e35e7697c420a4c63a856756b4ffa8c361e497ffc9d705d08436ed3a5c768756896e3b75100d67bc68e06b563d3f34c2e9b9fb4ff09440a0bda18

    • SSDEEP

      768:AjpppppppppepppppppppepppppppppepppppppppepppppppppNpppppppppepT:AE99+duVpx999+duVpx9

    Score
    3/10
    • Target

      ExtractAll/Readme/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).lnk

    • Size

      2KB

    • MD5

      56cc3193b2289919b689f837baeb6e6c

    • SHA1

      d50854ba733fda66cf8ce29f60312ee10c1dca89

    • SHA256

      adcc446e1b1cd00d20c56b3dd654bef51128875a76b24903d18270b09b7da081

    • SHA512

      37891494577ac912291f7af92d625b4a8399137f95134506686ac3a116e4f0289d13ecb04b0d14cecc8a239f0238776780eaee1609d24ff5cffe63bbe8468e01

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Target

      ExtractAll/Readme/A-Think Python How to Think Like a Computer Scientist, 3rd Edition (True PDF).pdf

    • Size

      3.7MB

    • MD5

      a7653852d9fbc23db8d3ec5ba7afbeb3

    • SHA1

      b58e16719ede8a0c35765e294ecfd9945d423e82

    • SHA256

      c648b9cbe10ac1726c4dd1845413ab4841950e892e6443b99fed662618c1e1a8

    • SHA512

      f97fc17be4dfd8ab5f662df16a808018189eeed344bf70b59bf03b1239edd33d04b631a93ac8a62676571cc16a9c0361cbb59c63283b1e223b781e28dad4024b

    • SSDEEP

      98304:Gzmv1E+J6yWHcHhjmpjE4Sn30HLVhZxXyz6PxyGj:BS+UAxmpjun30H7qCyGj

    Score
    1/10
    • Target

      ExtractAll/Readme/MyCover3.jpeg

    • Size

      925KB

    • MD5

      0adb9b817f1df7807576c2d7068dd931

    • SHA1

      4a1b94a9a5113106f40cd8ea724703734d15f118

    • SHA256

      98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

    • SHA512

      883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

    • SSDEEP

      24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK

    Score
    3/10
    • Target

      ExtractAll/Readme/MyCover4.jpg

    • Size

      83KB

    • MD5

      2bca0eb97a7c0825910517162251471c

    • SHA1

      52d878223c596cb2f130514125e427f6f87d686b

    • SHA256

      fa7b80f3d060c663691f7ede61847d7e1514145e569732af173f61e55ff6e72b

    • SHA512

      c2a5c544ac5e35e7697c420a4c63a856756b4ffa8c361e497ffc9d705d08436ed3a5c768756896e3b75100d67bc68e06b563d3f34c2e9b9fb4ff09440a0bda18

    • SSDEEP

      768:AjpppppppppepppppppppepppppppppepppppppppepppppppppNpppppppppepT:AE99+duVpx999+duVpx9

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks