General

  • Target

    44d3812093c41eaa74e65ccc2850f2dc4ae8c496df42e0b9e09e995097d6aa87

  • Size

    9.0MB

  • Sample

    250701-jt7jka11cx

  • MD5

    72c2b7c0201fee3ae182dbcaeb484e4a

  • SHA1

    42da5ad3468fd02693247f3eb02888db82a8f38b

  • SHA256

    44d3812093c41eaa74e65ccc2850f2dc4ae8c496df42e0b9e09e995097d6aa87

  • SHA512

    05fe200c88b6d6f672935c6ada60289f7069eacd6e9724be8cb13f5773f6f79bee53b89cd3b488b6f8cdda9aee66b4bb911e697f8c24d94be5ccb1dbc99202e1

  • SSDEEP

    98304:Zt2MIp9vm4m4xNTEY9xFUkcVwNSHfbv/kaIhThwMlEu:vcm4NTx9Pe20/zkaiuMlE

Malware Config

Targets

    • Target

      44d3812093c41eaa74e65ccc2850f2dc4ae8c496df42e0b9e09e995097d6aa87

    • Size

      9.0MB

    • MD5

      72c2b7c0201fee3ae182dbcaeb484e4a

    • SHA1

      42da5ad3468fd02693247f3eb02888db82a8f38b

    • SHA256

      44d3812093c41eaa74e65ccc2850f2dc4ae8c496df42e0b9e09e995097d6aa87

    • SHA512

      05fe200c88b6d6f672935c6ada60289f7069eacd6e9724be8cb13f5773f6f79bee53b89cd3b488b6f8cdda9aee66b4bb911e697f8c24d94be5ccb1dbc99202e1

    • SSDEEP

      98304:Zt2MIp9vm4m4xNTEY9xFUkcVwNSHfbv/kaIhThwMlEu:vcm4NTx9Pe20/zkaiuMlE

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks