6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003

General

Target

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003
Size

212KB
Sample

221124-kbraasbc92
MD5

a5848ff1c72dd9ceb3fd8cc5dfe7cd42
SHA1

c969575fee6acd2cf0bf2356932a104078f65327
SHA256

6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003
SHA512

6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8
SSDEEP

3072:1+kZqVeInSk82TfatZ9mD5fvNj6kECsjZ:1jaSk8iCtPmD5Hl6ysN

Score

10^/10

Malware Config

Targets

- Target
  
  6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003
- Size
  
  212KB
- MD5
  
  a5848ff1c72dd9ceb3fd8cc5dfe7cd42
- SHA1
  
  c969575fee6acd2cf0bf2356932a104078f65327
- SHA256
  
  6a4a0a26a1f21fc9490e5da5cc5cfc71d86a8b2d47c98cdf6326375f71ad4003
- SHA512
  
  6fbdb1fc0bf5adb14cb4a4c0a5c8bf92ceabadecf0d9c085e1ff9e15fafe5b2744913b680cd6591cb322827774ba01682fd943719fc49b5d039bfb3c975244b8
- SSDEEP
  
  3072:1+kZqVeInSk82TfatZ9mD5fvNj6kECsjZ:1jaSk8iCtPmD5Hl6ysN
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2