d34fbe9ec9a27f20ccfd1ca034c6ab62d4fb958c6400cf3976c332cae10e0da0

General

Target

d34fbe9ec9a27f20ccfd1ca034c6ab62d4fb958c6400cf3976c332cae10e0da0
Size

493KB
Sample

221123-ltcqasff7x
MD5

aa5baceedd152402651c8c64dd859dce
SHA1

d55766c28cecccb6f0b4c6401cb779d4307c7800
SHA256

d34fbe9ec9a27f20ccfd1ca034c6ab62d4fb958c6400cf3976c332cae10e0da0
SHA512

02c1eaca00900c673ce43e7eac49dedf2127cc5ac80f8d2468b9961653013e052f3bdd768c7fe8d8a1a7344a5a898f51fa21886c1b69450508207340a9fb5eb9
SSDEEP

1536:9NhENNo2oa5pHwAVvu0IysOPv3YdI3EpCK+V5iR/yKoDn66XujshkGXE7rFKh:9gN5ogyJ0XgdsEIKlyKo26Jkj7rF

Score

10^/10

Malware Config

Targets

- Target
  
  d34fbe9ec9a27f20ccfd1ca034c6ab62d4fb958c6400cf3976c332cae10e0da0
- Size
  
  493KB
- MD5
  
  aa5baceedd152402651c8c64dd859dce
- SHA1
  
  d55766c28cecccb6f0b4c6401cb779d4307c7800
- SHA256
  
  d34fbe9ec9a27f20ccfd1ca034c6ab62d4fb958c6400cf3976c332cae10e0da0
- SHA512
  
  02c1eaca00900c673ce43e7eac49dedf2127cc5ac80f8d2468b9961653013e052f3bdd768c7fe8d8a1a7344a5a898f51fa21886c1b69450508207340a9fb5eb9
- SSDEEP
  
  1536:9NhENNo2oa5pHwAVvu0IysOPv3YdI3EpCK+V5iR/yKoDn66XujshkGXE7rFKh:9gN5ogyJ0XgdsEIKlyKo26Jkj7rF
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2