General
- Target Trojan_Samples_Ready_For_VM.zip
- Size 9.6MB
- Sample260822-h53jbawxes
- SHA256 b841990413e10f2539c3727dc3910255b7f69a4fe297961fa191a42510ccceba
Malware Config
Targets
-
- Target Samples/Runtime.exe
- Size 1.1MB
- SHA256 d45f386629933cf2be6516e1d33ec74f78634424ba0400a95f2ecae29683c96f
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target Samples/UpdateCoreDrivers.exe
- Size 13KB
- SHA256 c631d24f8f5b403c977dbf08016b74eb9eb71625b3f9f208f3f6a69d9555321c
Score3/10 -
- Target Samples/WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
Score3/10 -
- Target Samples/taskhostupdate.exe
- Size 13.6MB
- SHA256 5da72a806c3e7eb77f267d9becfdb21256426b4936ca014301c83fabc997fd21
Score8/10-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target Samples/update.exe
- Size 975KB
- SHA256 909baff90c1c2652bc5e2a4d27f18c3d5a70e7830bd41bc37ddff1aa7ae3d40e
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target Samples/updater.exe
- Size 6.1MB
- SHA256 e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1