85ed2a26c7f272a5abc232f3027fb2f2898e7fca5a23c921d91bcecff16f7042

General

Target

85ed2a26c7f272a5abc232f3027fb2f2898e7fca5a23c921d91bcecff16f7042
Size

1.0MB
Sample

221124-asww1aad9w
MD5

516a264d8e43a5ddd5353693b300e4d5
SHA1

d45b6b317c1eb73872fd4c1ea73d714e4b2ee040
SHA256

85ed2a26c7f272a5abc232f3027fb2f2898e7fca5a23c921d91bcecff16f7042
SHA512

c05d08f51dc0454a682ea4ebdd56bd4e6b8f5d9763fb69c7dfc7058e416ede6d6ac86160027dccda5134b05ef3eed0fe3b9fc3096fdfb0238259fce806d7ed61
SSDEEP

1536:SNIkp2IdtEo1gbsSklrZWNXuQHPGrQ+wEaYNyZf/3Qcn6aNirob1e4p24JMdWqhM:9YvEo13SklFWNVerQ+KMspBMgX24iE

Score

10^/10

Malware Config

Targets

- Target
  
  85ed2a26c7f272a5abc232f3027fb2f2898e7fca5a23c921d91bcecff16f7042
- Size
  
  1.0MB
- MD5
  
  516a264d8e43a5ddd5353693b300e4d5
- SHA1
  
  d45b6b317c1eb73872fd4c1ea73d714e4b2ee040
- SHA256
  
  85ed2a26c7f272a5abc232f3027fb2f2898e7fca5a23c921d91bcecff16f7042
- SHA512
  
  c05d08f51dc0454a682ea4ebdd56bd4e6b8f5d9763fb69c7dfc7058e416ede6d6ac86160027dccda5134b05ef3eed0fe3b9fc3096fdfb0238259fce806d7ed61
- SSDEEP
  
  1536:SNIkp2IdtEo1gbsSklrZWNXuQHPGrQ+wEaYNyZf/3Qcn6aNirob1e4p24JMdWqhM:9YvEo13SklFWNVerQ+KMspBMgX24iE
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2