General

  • Target

    AlphaClicker.exe

  • Size

    246KB

  • Sample

    241104-zg9fdswmgz

  • MD5

    018766bcfa72a30a09f2df9755b7a24a

  • SHA1

    f7a3dfbda9e1ca854ff4514454cb95854c9a084d

  • SHA256

    84f3e2049740ebbcfb5fe827cc6068c6f8691bcaefa781a9f2af7a07d944443b

  • SHA512

    b28f3809dc25b693987de94afca04ce79aa2a8aaf96a919b5f9a56cb0a7af8482429a4bdefd0a4d161e9ba8edce8b21501a318c46310492e8474f4de06ff2cc3

  • SSDEEP

    768:asSphzlEoEri9tFScvOZa86xscFJgZYhPzvhynQuMceIFtksROFJgIYAPiv3:asUbsi9tscvwS7DgWtdJhceIoZDgfgC

Malware Config

Targets

    • Target

      AlphaClicker.exe

    • Size

      246KB

    • MD5

      018766bcfa72a30a09f2df9755b7a24a

    • SHA1

      f7a3dfbda9e1ca854ff4514454cb95854c9a084d

    • SHA256

      84f3e2049740ebbcfb5fe827cc6068c6f8691bcaefa781a9f2af7a07d944443b

    • SHA512

      b28f3809dc25b693987de94afca04ce79aa2a8aaf96a919b5f9a56cb0a7af8482429a4bdefd0a4d161e9ba8edce8b21501a318c46310492e8474f4de06ff2cc3

    • SSDEEP

      768:asSphzlEoEri9tFScvOZa86xscFJgZYhPzvhynQuMceIFtksROFJgIYAPiv3:asUbsi9tscvwS7DgWtdJhceIoZDgfgC

    • Modifies WinLogon for persistence

    • UAC bypass

    • Renames multiple (145) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks