General

  • Target

    3d3d3e688ed64e61981a53ed0afb9f8202e4c4b1d41bb4fc4345df23db0b0085

  • Size

    7.9MB

  • Sample

    241108-qca8csshqk

  • MD5

    f77cedb9ca732a2858ce78478655b8de

  • SHA1

    bdc1db341c77164d3eaf14ef8690b9e6a61935df

  • SHA256

    3d3d3e688ed64e61981a53ed0afb9f8202e4c4b1d41bb4fc4345df23db0b0085

  • SHA512

    fa7810e698b3e060b36238f369f67145fe62c5c3d4714dacc03af528e33ab3891867b9941a5ee593cdb946c5eae8c0bba2787ee3b335c3055556f7619c270103

  • SSDEEP

    98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

Malware Config

Targets

    • Target

      3d3d3e688ed64e61981a53ed0afb9f8202e4c4b1d41bb4fc4345df23db0b0085

    • Size

      7.9MB

    • MD5

      f77cedb9ca732a2858ce78478655b8de

    • SHA1

      bdc1db341c77164d3eaf14ef8690b9e6a61935df

    • SHA256

      3d3d3e688ed64e61981a53ed0afb9f8202e4c4b1d41bb4fc4345df23db0b0085

    • SHA512

      fa7810e698b3e060b36238f369f67145fe62c5c3d4714dacc03af528e33ab3891867b9941a5ee593cdb946c5eae8c0bba2787ee3b335c3055556f7619c270103

    • SSDEEP

      98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks