Resubmissions

14/06/2024, 17:59

240614-wkp95svbrq 7

14/06/2024, 17:57

240614-wj3tva1bld 7

10/06/2024, 02:34

240610-c2lhqsbe39 7

General

  • Target

    sapsan.exe

  • Size

    2.0MB

  • Sample

    240614-wkp95svbrq

  • MD5

    53099afa75043ea832b64db81231caff

  • SHA1

    86a1e59a058e26fec0765571291e98d17dafca12

  • SHA256

    1e7223bc42e7aa07035b6deb1c3cedd2cba26b522227548061b5723bf744ae3c

  • SHA512

    45fda7812770b1748c8163cc3bd77f96e37390874f734b2a0757457252b3c64bd600fa562f472aaa512f6923fecbd0effc4ddaf670697304e7d7020bf16e6495

  • SSDEEP

    24576:7wXn4671GiW2nM/2hXNzpwxIiN23hRKYrDobbd0sCGHjc3Z8FdgPFGA0:7wXn37hNVwxIR3GHg3ZbPy

Malware Config

Targets

    • Target

      sapsan.exe

    • Size

      2.0MB

    • MD5

      53099afa75043ea832b64db81231caff

    • SHA1

      86a1e59a058e26fec0765571291e98d17dafca12

    • SHA256

      1e7223bc42e7aa07035b6deb1c3cedd2cba26b522227548061b5723bf744ae3c

    • SHA512

      45fda7812770b1748c8163cc3bd77f96e37390874f734b2a0757457252b3c64bd600fa562f472aaa512f6923fecbd0effc4ddaf670697304e7d7020bf16e6495

    • SSDEEP

      24576:7wXn4671GiW2nM/2hXNzpwxIiN23hRKYrDobbd0sCGHjc3Z8FdgPFGA0:7wXn37hNVwxIR3GHg3ZbPy

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks