f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1

General

Target

f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1
Size

255KB
Sample

221029-dxgvesagbp
MD5

cc7af66cbf75ec24dfd790cb33743f81
SHA1

47dbb042e55dc2bc1ab2f6236cd2644e23d5f1e7
SHA256

f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1
SHA512

045753b5af1660ce7afe898da9af9dc0fef8e2e9c7f401f5b4a85326f4a376a691fb66e8c246b40ac0880735351a5d33dfa667519db888f9d96448fad0a66c48
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIQ

Score

10^/10

Malware Config

Targets

- Target
  
  f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1
- Size
  
  255KB
- MD5
  
  cc7af66cbf75ec24dfd790cb33743f81
- SHA1
  
  47dbb042e55dc2bc1ab2f6236cd2644e23d5f1e7
- SHA256
  
  f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1
- SHA512
  
  045753b5af1660ce7afe898da9af9dc0fef8e2e9c7f401f5b4a85326f4a376a691fb66e8c246b40ac0880735351a5d33dfa667519db888f9d96448fad0a66c48
- SSDEEP
  
  3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIQ
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2