General

  • Target

    601f7df2828a77fd168393bd97b3e60b8382bbb56ec566fa3de5672e5e5770a2N.exe

  • Size

    379KB

  • Sample

    241111-n43etasmck

  • MD5

    796c7dc7151bcf72512c259ee81381c6

  • SHA1

    35d562d415c57c122d2f08909e9d174d310eb483

  • SHA256

    f578d64ec7260058c28c7afd7267bbc45d86a0e67556f9d0482240ff95e5a775

  • SHA512

    1e021c7a7e0a5aa4f741a3e9475fc46eea51c16d4862569c2ffad05c79f983d3406bc54b128841e8747b3a24afcfdeb9fdd9875265988bd8952b22abdb1ed73b

  • SSDEEP

    6144:ShBqzv2w/0s/DbAgeonk7n7m8po+yUOKKNG0IxSjXKP+89H:kqzv2wsEDbZ67fpLyUB/5qL8Z

Malware Config

Targets

    • Target

      601f7df2828a77fd168393bd97b3e60b8382bbb56ec566fa3de5672e5e5770a2N.exe

    • Size

      379KB

    • MD5

      796c7dc7151bcf72512c259ee81381c6

    • SHA1

      35d562d415c57c122d2f08909e9d174d310eb483

    • SHA256

      f578d64ec7260058c28c7afd7267bbc45d86a0e67556f9d0482240ff95e5a775

    • SHA512

      1e021c7a7e0a5aa4f741a3e9475fc46eea51c16d4862569c2ffad05c79f983d3406bc54b128841e8747b3a24afcfdeb9fdd9875265988bd8952b22abdb1ed73b

    • SSDEEP

      6144:ShBqzv2w/0s/DbAgeonk7n7m8po+yUOKKNG0IxSjXKP+89H:kqzv2wsEDbZ67fpLyUB/5qL8Z

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks