General

  • Target

    AtomrineSetup.exe

  • Size

    164KB

  • Sample

    241116-stlfrsyfln

  • MD5

    7b5754dc88359e3475a9f6e42ec274d4

  • SHA1

    c6e7cb61216cba1de7e5b83eeaf20725435561fd

  • SHA256

    c144fb682278c5dae6d4daafa49b0c63d6181e4b26055abaa676b267ca18890b

  • SHA512

    f8ed64a36795f1faaaa2771dbf40302a07c02794f7c7a2b7a9e228dcb135de0f22700ce2d228269b456b73b194a69b82170d0d095fcfc0bf60d38b4b2ea3e637

  • SSDEEP

    3072:qahKyd2n31d5GWp1icKAArDZz4N9GhbkrNEkO9gk:qahOxp0yN90QEH

Malware Config

Targets

    • Target

      AtomrineSetup.exe

    • Size

      164KB

    • MD5

      7b5754dc88359e3475a9f6e42ec274d4

    • SHA1

      c6e7cb61216cba1de7e5b83eeaf20725435561fd

    • SHA256

      c144fb682278c5dae6d4daafa49b0c63d6181e4b26055abaa676b267ca18890b

    • SHA512

      f8ed64a36795f1faaaa2771dbf40302a07c02794f7c7a2b7a9e228dcb135de0f22700ce2d228269b456b73b194a69b82170d0d095fcfc0bf60d38b4b2ea3e637

    • SSDEEP

      3072:qahKyd2n31d5GWp1icKAArDZz4N9GhbkrNEkO9gk:qahOxp0yN90QEH

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks