f1e4f74a68eefb552437406fd3cceec335e82a131e2d7a0a4c7986075f434c83

General

Target

f1e4f74a68eefb552437406fd3cceec335e82a131e2d7a0a4c7986075f434c83
Size

877KB
Sample

221011-d88ghschh4
MD5

6363aad0fbfdfa08323a3f6cfe321440
SHA1

a7f6763bfb0c2b8a054493c409ac229f3cbb5717
SHA256

f1e4f74a68eefb552437406fd3cceec335e82a131e2d7a0a4c7986075f434c83
SHA512

67c018b7dd4a946ec07e8cc0607a44c371d4a8318df258dc8d2e5a2b145f0a96ec88d193157002d183aee093bd821b919919b661652a8731944bfd0c24f6941e
SSDEEP

1536:/YlgdBR/zfjtgs0vyQhYxfQpY6wsMYk2bY0jMjx+J1gxvV3JrwRJ9qMnpvs:8QPjRgqMMQtMYM0+AQxvVmQ0p

Score

10^/10

Malware Config

Targets

- Target
  
  f1e4f74a68eefb552437406fd3cceec335e82a131e2d7a0a4c7986075f434c83
- Size
  
  877KB
- MD5
  
  6363aad0fbfdfa08323a3f6cfe321440
- SHA1
  
  a7f6763bfb0c2b8a054493c409ac229f3cbb5717
- SHA256
  
  f1e4f74a68eefb552437406fd3cceec335e82a131e2d7a0a4c7986075f434c83
- SHA512
  
  67c018b7dd4a946ec07e8cc0607a44c371d4a8318df258dc8d2e5a2b145f0a96ec88d193157002d183aee093bd821b919919b661652a8731944bfd0c24f6941e
- SSDEEP
  
  1536:/YlgdBR/zfjtgs0vyQhYxfQpY6wsMYk2bY0jMjx+J1gxvV3JrwRJ9qMnpvs:8QPjRgqMMQtMYM0+AQxvVmQ0p
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2