General

  • Target

    Built.exe

  • Size

    7.6MB

  • Sample

    250103-cvsngaylcn

  • MD5

    2cdea704648275712d9ef27d863acb97

  • SHA1

    a736fb38eaf279dc46d8af3e985d9e85669dfabe

  • SHA256

    002755166acb2506ff0a3b6446a5bf6502832122f7f95aee501beb137b8f8518

  • SHA512

    82f45d8f1c5e0ec43c3de04e2e733929799925e933bd2c049962b85016917167e4c677e67f422dbd41e603c8ec2958a1c20117c0a88515342f45af2a743f6bd9

  • SSDEEP

    196608:q6D+kdLwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWu:D52IHL7HmBYXrYoaUNx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      7.6MB

    • MD5

      2cdea704648275712d9ef27d863acb97

    • SHA1

      a736fb38eaf279dc46d8af3e985d9e85669dfabe

    • SHA256

      002755166acb2506ff0a3b6446a5bf6502832122f7f95aee501beb137b8f8518

    • SHA512

      82f45d8f1c5e0ec43c3de04e2e733929799925e933bd2c049962b85016917167e4c677e67f422dbd41e603c8ec2958a1c20117c0a88515342f45af2a743f6bd9

    • SSDEEP

      196608:q6D+kdLwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWu:D52IHL7HmBYXrYoaUNx

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks