General

  • Target

    Shadow V2 Loader.exe

  • Size

    8.2MB

  • Sample

    241121-1jv68asngn

  • MD5

    8928dfcda18d095d6829235933a0f106

  • SHA1

    be38746995e07e15491ce25591c62ef17f37d42d

  • SHA256

    025714a59d519ade8c78d78e49fe4bdfbccb0b4ee008126d74cda3f7022b0e98

  • SHA512

    9bd4adc02a582c7b337399e98ae095e08087b69e4d7b634e9394a7ec6d0224b729c2414e4a814fa8bb68def64c650bc8fa32dcc76604378a908b9b892833d1a0

  • SSDEEP

    196608:9Ag8VEJwfI9jUC2gYBYv3vbW4SEf+iITx1U6ny:78VE2IH2gYBgDWZjTnzy

Malware Config

Targets

    • Target

      Shadow V2 Loader.exe

    • Size

      8.2MB

    • MD5

      8928dfcda18d095d6829235933a0f106

    • SHA1

      be38746995e07e15491ce25591c62ef17f37d42d

    • SHA256

      025714a59d519ade8c78d78e49fe4bdfbccb0b4ee008126d74cda3f7022b0e98

    • SHA512

      9bd4adc02a582c7b337399e98ae095e08087b69e4d7b634e9394a7ec6d0224b729c2414e4a814fa8bb68def64c650bc8fa32dcc76604378a908b9b892833d1a0

    • SSDEEP

      196608:9Ag8VEJwfI9jUC2gYBYv3vbW4SEf+iITx1U6ny:78VE2IH2gYBgDWZjTnzy

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks