General
-
Target
62d24c9c7a8c97ecbeb717aaa26bcd65e85e00f71308936ab76b1f056d550ecf
-
Size
1.7MB
-
Sample
221029-yn6gmscgd2
-
MD5
840c72044af5de505ebe7f1b2f1754db
-
SHA1
9e83dcc92ae041de9e528a021ad0594341316c9e
-
SHA256
62d24c9c7a8c97ecbeb717aaa26bcd65e85e00f71308936ab76b1f056d550ecf
-
SHA512
4eefbb7eacd26d8b9bac439f0362a18d30981564bedd022e517afcf088f419a12b922a8698d595e76d9e02a4e9ee61d0028f062b405992324b4489c68e4174ef
-
SSDEEP
24576:VRoEFOGDF+ErEj4X8ISAv+Gh91Cr9F1sZKTb7z9/GY+i6rpzx6I56L3/UcPX:VXDFXtX8VxGL1OeYb9/GS0iLPUAX
Malware Config
Targets
-
-
Target
62d24c9c7a8c97ecbeb717aaa26bcd65e85e00f71308936ab76b1f056d550ecf
-
Size
1.7MB
-
MD5
840c72044af5de505ebe7f1b2f1754db
-
SHA1
9e83dcc92ae041de9e528a021ad0594341316c9e
-
SHA256
62d24c9c7a8c97ecbeb717aaa26bcd65e85e00f71308936ab76b1f056d550ecf
-
SHA512
4eefbb7eacd26d8b9bac439f0362a18d30981564bedd022e517afcf088f419a12b922a8698d595e76d9e02a4e9ee61d0028f062b405992324b4489c68e4174ef
-
SSDEEP
24576:VRoEFOGDF+ErEj4X8ISAv+Gh91Cr9F1sZKTb7z9/GY+i6rpzx6I56L3/UcPX:VXDFXtX8VxGL1OeYb9/GS0iLPUAX
Score10/10-
UAC bypass
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-