General

  • Target

    98cd8888b16fb75f07abdbacc4ca8f42af845c28b4a9158a17c9464596c4c991.zip

  • Size

    27.0MB

  • Sample

    241218-dqs9wasjgn

  • MD5

    aaf24a93d1abc27ab420ade4b5d44392

  • SHA1

    682982ff355ff27454375a514533b4fc0f75e5d0

  • SHA256

    98cd8888b16fb75f07abdbacc4ca8f42af845c28b4a9158a17c9464596c4c991

  • SHA512

    03d21af34260da66685d5df34d64cb031ccc4d3fa857443c070f1a3e7b49419e4e506255079a2d76f8e84aa26f16de59cebfa8794d98e8e3475a996a6d0bc27b

  • SSDEEP

    786432:CKhFcE29w2zvUKs0Oie4fYHSBTWEw4nE8EEqhE:XawzD064PTWAfwE

Malware Config

Targets

    • Target

      pek-main/WindowsUpdateAgent.exe

    • Size

      7.6MB

    • MD5

      2df1acdba7ff59239fef9db4268e02c9

    • SHA1

      6d41b2d40f078b4252afa118f94e0f3ed56e3e40

    • SHA256

      4cf2908dfd708e46dea0dcd3f8654c037d9205b308f44ed5b4ac670b11e2b0ad

    • SHA512

      96b00d012a4300be0609e24dfbfd4663fbede2131ca8d2ae8a9b95848e989a3b4422ad54e6778288a2d806800e5fd702fa75a36fe478788dd6a995981ce5d5a9

    • SSDEEP

      196608:KC0SKleNTfm/pf+xk4dNSESRGtrbWOjgWyu:9y/pWu4m5RGtrbvMWyu

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      pek-main/sonrise.jar

    • Size

      20.1MB

    • MD5

      35104d7c2b898e95d2376dae16480947

    • SHA1

      63e5393576254cf8f0a2bc98c685a42725ae5816

    • SHA256

      214e9a22cfc442496b56584cc6fc8127a36b647652d532c67c091c1bd546a3a7

    • SHA512

      778222e37dd395850a65d30ffd4e9818b6fd9b381d3dbae0e66585ad2f2785e908938dfadbc3c4ef83652c59d407697a27c9a33fb973ef0e8435aa07c31e1b98

    • SSDEEP

      393216:2ypV3BNHWn22TgCWb+S0wjCeZqz7tCJXh9Qmw73gCcwzadJovsXWeGN+DA:2eFQ2rGSfCtCJXTqzgCcwz2oEXU

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks