8e69b0ac412d84b3611186d381646bf8c6e8539f9e440ba37575757eb4e4c6db

General

Target

8e69b0ac412d84b3611186d381646bf8c6e8539f9e440ba37575757eb4e4c6db
Size

679KB
Sample

221029-qj6mvaggg3
MD5

b64e5ca6e83fbb920699bd40ee6aefbb
SHA1

d7a0d458d27784b9f28bcd11ed742e325651c382
SHA256

8e69b0ac412d84b3611186d381646bf8c6e8539f9e440ba37575757eb4e4c6db
SHA512

0f92c342ddba695d9901f93b24b9c5ddbe17c69eea5551bbf6b5dca5e9ab2b346a85beb5a855f3ccea787d3be29a326d943e9874cfbae64d57d1fb9f631625e8
SSDEEP

3072:dJssXHrm2EPABbsdgVbZoAc7R+cgSkwkFFAoP4D:PXrm2EPAFsd6U7R+BFx

Score

10^/10

Malware Config

Targets

- Target
  
  8e69b0ac412d84b3611186d381646bf8c6e8539f9e440ba37575757eb4e4c6db
- Size
  
  679KB
- MD5
  
  b64e5ca6e83fbb920699bd40ee6aefbb
- SHA1
  
  d7a0d458d27784b9f28bcd11ed742e325651c382
- SHA256
  
  8e69b0ac412d84b3611186d381646bf8c6e8539f9e440ba37575757eb4e4c6db
- SHA512
  
  0f92c342ddba695d9901f93b24b9c5ddbe17c69eea5551bbf6b5dca5e9ab2b346a85beb5a855f3ccea787d3be29a326d943e9874cfbae64d57d1fb9f631625e8
- SSDEEP
  
  3072:dJssXHrm2EPABbsdgVbZoAc7R+cgSkwkFFAoP4D:PXrm2EPAFsd6U7R+BFx
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2