General

  • Target

    AkrienBeta.rar

  • Size

    8.2MB

  • Sample

    241006-yh74aawgrf

  • MD5

    9c16377d6625d05623d21dd82580a887

  • SHA1

    7e47bc9ecbd479e7c6edb075c9db3c548f527568

  • SHA256

    85ff3302cf0e4ce4afca38e8e643456515b18aaa457d47e9c6a22b54bd655639

  • SHA512

    0dac97308418b9db7129402f4abb810ffa17482a1e49d278b28a070ba96f31b7fd0d2de55021233b6249548e54e1745d524ddba5114bc6b0a56caa8f031058c7

  • SSDEEP

    196608:DEg3ahxzDkqG6JNBRj+z4MgRSMzc9+4+3ShRCGN33oE3I:D3aPRNbuz4zRSMzcU4+3ShRCGN33oE3I

Malware Config

Targets

    • Target

      Akrien.exe

    • Size

      8.3MB

    • MD5

      ab0386ba161312b4dd95bcf5dccf0857

    • SHA1

      21f59e2d604192ba0bace9ef6677a0c446e73a24

    • SHA256

      9ac1e8afeb9b4fa8e960ea2a26835b40920575b83d503f959056ab5d37a17790

    • SHA512

      c490c5c1c355097b90cddd6894bf205278d4469cedf398b2f919233ba8bf4818935138d2733fa41655dbe816e928db79d2aad821739e69af6342075a0ff5707f

    • SSDEEP

      196608:FyuqmN0ZqZJzwfI9jUC2XMvH8zPjweaBpZ0cM6T2ooccXK7oSV:rOLIH2XgHq+jq8S3YoY

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.