General

  • Target

    408807ac29af822d783b1d26146c8f1c2c1d3b13b14ec6ca0765141dc721130f

  • Size

    89KB

  • Sample

    250115-3fzrcazldx

  • MD5

    84bc8cf362f8956475d94d5bd9524ff2

  • SHA1

    daff34753ea43ab31cc9d75409a24125375b29d4

  • SHA256

    408807ac29af822d783b1d26146c8f1c2c1d3b13b14ec6ca0765141dc721130f

  • SHA512

    c8e2013ba8fe7bd899aa68fe3be0817799c00fbbb444ff66f4d7abf6d64730cd068339acaa75c396aea8028f257d1125946b6fdf35b8383300d725168a1a6ffb

  • SSDEEP

    768:qGHV45EDE477AZbUJx0rZGE3jCELoiMMj6hZ3nE+EXVmkDbjRL8Khc15Z6J1S:qG14P477AxUYrZGoC09k0SkTRHhWqP

Malware Config

Targets

    • Target

      408807ac29af822d783b1d26146c8f1c2c1d3b13b14ec6ca0765141dc721130f

    • Size

      89KB

    • MD5

      84bc8cf362f8956475d94d5bd9524ff2

    • SHA1

      daff34753ea43ab31cc9d75409a24125375b29d4

    • SHA256

      408807ac29af822d783b1d26146c8f1c2c1d3b13b14ec6ca0765141dc721130f

    • SHA512

      c8e2013ba8fe7bd899aa68fe3be0817799c00fbbb444ff66f4d7abf6d64730cd068339acaa75c396aea8028f257d1125946b6fdf35b8383300d725168a1a6ffb

    • SSDEEP

      768:qGHV45EDE477AZbUJx0rZGE3jCELoiMMj6hZ3nE+EXVmkDbjRL8Khc15Z6J1S:qG14P477AxUYrZGoC09k0SkTRHhWqP

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks