a9b05637be91f963cb0c8806af7dcc0093f4a210d68bf51c116ae03cf3628a29

General

Target

a9b05637be91f963cb0c8806af7dcc0093f4a210d68bf51c116ae03cf3628a29
Size

244KB
Sample

221123-s8cr6sgd21
MD5

f823136cc75e246328d0a41983fc63d4
SHA1

6ed5ab4a7a16039c9a83b85281e1795c6e464396
SHA256

a9b05637be91f963cb0c8806af7dcc0093f4a210d68bf51c116ae03cf3628a29
SHA512

4f1607d6938ebc690a43699e605381669195ad44f82a73104608791e7263db16cdb28350f5dd388cd94f87d30f3b327f647b54e7f120b1a75fc4e5ab9aea9b4b
SSDEEP

3072:BOJoplT2mX2MIaVLXM0Lgqfp7+H4De2dN+K/p7ZwtD6:PlTTtIOXjgqt+0Zp1wl6

Score

10^/10

Malware Config

Targets

- Target
  
  a9b05637be91f963cb0c8806af7dcc0093f4a210d68bf51c116ae03cf3628a29
- Size
  
  244KB
- MD5
  
  f823136cc75e246328d0a41983fc63d4
- SHA1
  
  6ed5ab4a7a16039c9a83b85281e1795c6e464396
- SHA256
  
  a9b05637be91f963cb0c8806af7dcc0093f4a210d68bf51c116ae03cf3628a29
- SHA512
  
  4f1607d6938ebc690a43699e605381669195ad44f82a73104608791e7263db16cdb28350f5dd388cd94f87d30f3b327f647b54e7f120b1a75fc4e5ab9aea9b4b
- SSDEEP
  
  3072:BOJoplT2mX2MIaVLXM0Lgqfp7+H4De2dN+K/p7ZwtD6:PlTTtIOXjgqt+0Zp1wl6
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2