General

  • Target

    1361598.jpeg

  • Size

    1.5MB

  • Sample

    240806-185f7asekn

  • MD5

    fd03ed7b635cda0542f67fcf960dc32b

  • SHA1

    e55a8a919645b46b49fb7e2c4ab6ef873248b95d

  • SHA256

    544660a2c40f13d55c288a132485ec78a83482abc3f9b56f25a141513fcfd2f2

  • SHA512

    8e73c36111366e3a473b80a9f6479dd0998e45b5b35f0cb80caef38c6758be1506871aed784d3f35d9e76604d3ca22e0b81f1db7d894b01605127be57e7a7211

  • SSDEEP

    49152:/QWbKHva5+ff5trxt9L4fxcHNh1G3+OvKjfhQ7cB:/dOHvTfGfcNhAuOvK7t

Malware Config

Targets

    • Target

      1361598.jpeg

    • Size

      1.5MB

    • MD5

      fd03ed7b635cda0542f67fcf960dc32b

    • SHA1

      e55a8a919645b46b49fb7e2c4ab6ef873248b95d

    • SHA256

      544660a2c40f13d55c288a132485ec78a83482abc3f9b56f25a141513fcfd2f2

    • SHA512

      8e73c36111366e3a473b80a9f6479dd0998e45b5b35f0cb80caef38c6758be1506871aed784d3f35d9e76604d3ca22e0b81f1db7d894b01605127be57e7a7211

    • SSDEEP

      49152:/QWbKHva5+ff5trxt9L4fxcHNh1G3+OvKjfhQ7cB:/dOHvTfGfcNhAuOvK7t

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    • Detected potential entity reuse from brand steam.

MITRE ATT&CK Enterprise v15

Tasks