5ba0049fcf598bacfdd770cdaa34970503305e787cf34cf91253130e48f5025d

General

Target
Notificación02946Resolución34602MYPXF.zip
Size 2.3MB
Sample221116-epb5msha98
SHA256 5ba0049fcf598bacfdd770cdaa34970503305e787cf34cf91253130e48f5025d
MD5 0e671489eda640057b64a8bcc41030f1
SHA1 81667866343dff31dc76f5233a22aabb81f4a2a4
SHA512 f593b1ed05d43bea096431800e7fb8dd5a2ba461d4c599674b3acf364a8010d153d08a015e4442ca1a9d16146569905e1f26ff3e457953703a5fdaaf798d956f
SSDEEP 49152:QpH2fe8DgDbBNkCmGmH2m6tRbs8RLGVmVFDjc2+eta/vNT1YH:QpH2GbTiJgbVdGVWkbeevNhYH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  --------------------------------------------A48020.xml
- Size 12KB
- SHA256 be9f858306daf9c886fbe579db2f788a21a5531c7d0028b6d663fac43ffaeb0c
- MD5 20993d0e3f4ce09f39cd119624f3541d
- SHA1 e1ad60184a03f48217ab48742b1e2e141272d829
- SHA512 1997c07f0cec3df29a849c1a950ffe80b9c3259d73a43b8a90cc99341fbdfb123f7d6825a5ed1020607261aa5ddd8c089ec3a2ba4bed8c4904fb8e95d445dd33
- SSDEEP 192:PZWVghWcRIYiYF8r7S4maIYiYF8r7SvOjuFW:RW2hWoIYiE4maIYiE22W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Notificacin50516Resolucin62721NKKDR.exe
- Size 318.0MB
- SHA256 d6022d2f458aaa9cc003165944c962eed4981c2758f6deaff8b9194d18f0d7e0
- MD5 c2327365a32c2c11ac89f263627f3454
- SHA1 bfe6800119adbbef8af75d0bc0486764bcb15b9e
- SHA512 fd77a44c9763ae2157dadf220e480c24c13d08c81bc1b61012784a1eceda7893d1a0ae4612c886db6eeebeb3d20920bdeb071388e7db44b594c8fe19e8adf4ef
- SSDEEP 49152:CBNugUbsQ1AKVXSE5dHAqcoMicXHs+1b4IcpwSIVOo9/8dj0rdd9PVYoN9GGbBGs:Cb37KMidm8pwRoo9/8cfJB2L
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4