General

  • Target

    5bd854446f61126cdd7bf9c2d83f87b2a3de3ffe70b8228052d59e403f47d829

  • Size

    7.9MB

  • Sample

    241112-sbev9syjbk

  • MD5

    b218072921b2fbeec420082aed819a7a

  • SHA1

    a0be135cba6e5efaf18a9e966ac2140f7b6cd543

  • SHA256

    5bd854446f61126cdd7bf9c2d83f87b2a3de3ffe70b8228052d59e403f47d829

  • SHA512

    827d95beed4bda3f1d09f6a9fb15d1b4542364fe719ad6946768e112aab12e29651d6a5827f64b478304b499940566e998e55b34ec6ba8d337604d567ffeb41a

  • SSDEEP

    98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

Malware Config

Targets

    • Target

      5bd854446f61126cdd7bf9c2d83f87b2a3de3ffe70b8228052d59e403f47d829

    • Size

      7.9MB

    • MD5

      b218072921b2fbeec420082aed819a7a

    • SHA1

      a0be135cba6e5efaf18a9e966ac2140f7b6cd543

    • SHA256

      5bd854446f61126cdd7bf9c2d83f87b2a3de3ffe70b8228052d59e403f47d829

    • SHA512

      827d95beed4bda3f1d09f6a9fb15d1b4542364fe719ad6946768e112aab12e29651d6a5827f64b478304b499940566e998e55b34ec6ba8d337604d567ffeb41a

    • SSDEEP

      98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks