ccfa8b97f8273be6e7fee1beb2330cc45ab8f152c5d1bfa8b04f7b3b0b603433

General

Target
7814d10ccac316da7b3616a9f4334590
Size 596KB
Sample210905-lvg2eacffj
SHA256 ccfa8b97f8273be6e7fee1beb2330cc45ab8f152c5d1bfa8b04f7b3b0b603433
MD5 7814d10ccac316da7b3616a9f4334590
SHA1 fc22d595a95d1f72772fff26e7b2659a131a491d
SHA512 b1b9c2b156504948342277ef621de6c36e3119bc8674000a343c417ea0f08c83142ab57fdef1d5c071af02a67a333e12972c4ccdb8abeb8547be905c81ca7c94
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  7814d10ccac316da7b3616a9f4334590
- Size 596KB
- SHA256 ccfa8b97f8273be6e7fee1beb2330cc45ab8f152c5d1bfa8b04f7b3b0b603433
- MD5 7814d10ccac316da7b3616a9f4334590
- SHA1 fc22d595a95d1f72772fff26e7b2659a131a491d
- SHA512 b1b9c2b156504948342277ef621de6c36e3119bc8674000a343c417ea0f08c83142ab57fdef1d5c071af02a67a333e12972c4ccdb8abeb8547be905c81ca7c94
- MD5 SHA1 SHA512
Score

10^/10

discovery evasion spyware stealer suricata themida trojan
- suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2