General

  • Target

    dc3fa975d9ae90ee01f5bd758aa27fdc9a424fb5cebed361cdecf0ca3d1c09b0N

  • Size

    195KB

  • Sample

    241021-k4kcfsxgma

  • MD5

    8271618257f377805ad1e4e5c7c8c6f0

  • SHA1

    99d23fb300f5417529c8c572817a9228ff602789

  • SHA256

    dc3fa975d9ae90ee01f5bd758aa27fdc9a424fb5cebed361cdecf0ca3d1c09b0

  • SHA512

    2143f14e70ebb4896a8ddb0063d7f3510d9b991d3c4e63db1432d219f91b66aa482242db8b2925403a360b7d1de89ce2bba4ab716b12a8ed2f325d23256552c9

  • SSDEEP

    6144:QIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCyOW:JKofHfHTXQLzgvnzHPowYbvrjD/L7QPo

Malware Config

Targets

    • Target

      dc3fa975d9ae90ee01f5bd758aa27fdc9a424fb5cebed361cdecf0ca3d1c09b0N

    • Size

      195KB

    • MD5

      8271618257f377805ad1e4e5c7c8c6f0

    • SHA1

      99d23fb300f5417529c8c572817a9228ff602789

    • SHA256

      dc3fa975d9ae90ee01f5bd758aa27fdc9a424fb5cebed361cdecf0ca3d1c09b0

    • SHA512

      2143f14e70ebb4896a8ddb0063d7f3510d9b991d3c4e63db1432d219f91b66aa482242db8b2925403a360b7d1de89ce2bba4ab716b12a8ed2f325d23256552c9

    • SSDEEP

      6144:QIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCyOW:JKofHfHTXQLzgvnzHPowYbvrjD/L7QPo

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks