42f23340a607533d7b8ba503fed6e4c17128060437964ab63d2e2303ef017a85

General

Target

42f23340a607533d7b8ba503fed6e4c17128060437964ab63d2e2303ef017a85
Size

309KB
Sample

220919-pj6r6sged6
MD5

05d8b28ef74d1c138df47be2594d8bec
SHA1

2fdc187da5ae3dded13e439ae458c8abfe4fc9a1
SHA256

42f23340a607533d7b8ba503fed6e4c17128060437964ab63d2e2303ef017a85
SHA512

07ee537d450c9bd4f57002381cb93a491a88058e3e3c133c26d2ad9c33d07b565b1493d72a17b01bfc6eafca5f2eb065b1177bab190a27a3c57ff425e944193f
SSDEEP

3072:3Ysgk+ruvdasTt9NHhayrHlbGAP1Qm02B545g4FuB3bBo6P6We0VyOjUoutZOfNv:ur/oSsR

Score

10^/10

Malware Config

Targets

- Target
  
  42f23340a607533d7b8ba503fed6e4c17128060437964ab63d2e2303ef017a85
- Size
  
  309KB
- MD5
  
  05d8b28ef74d1c138df47be2594d8bec
- SHA1
  
  2fdc187da5ae3dded13e439ae458c8abfe4fc9a1
- SHA256
  
  42f23340a607533d7b8ba503fed6e4c17128060437964ab63d2e2303ef017a85
- SHA512
  
  07ee537d450c9bd4f57002381cb93a491a88058e3e3c133c26d2ad9c33d07b565b1493d72a17b01bfc6eafca5f2eb065b1177bab190a27a3c57ff425e944193f
- SSDEEP
  
  3072:3Ysgk+ruvdasTt9NHhayrHlbGAP1Qm02B545g4FuB3bBo6P6We0VyOjUoutZOfNv:ur/oSsR
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2