453223fbd18b80abfcb0bf4af85a78270b6ab3698f2b869862cff5a6cabdac5e

General

Target

453223fbd18b80abfcb0bf4af85a78270b6ab3698f2b869862cff5a6cabdac5e
Size

255KB
Sample

221124-mhb53abd8t
MD5

64f88553c102da951f0061dfbf9a9ef9
SHA1

f78f13cc1f563b23a955034e5a5994cd8e67a26f
SHA256

453223fbd18b80abfcb0bf4af85a78270b6ab3698f2b869862cff5a6cabdac5e
SHA512

8b347b28b2be2f5ed3ec0ee6a7e859c2bd05888f0169efed1258f968ae15eec4cd694b83021962c4464ee71af3ca4f3d0f86139f390bebd4db321e65762ab757
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJo:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3

Score

10^/10

Malware Config

Targets

- Target
  
  453223fbd18b80abfcb0bf4af85a78270b6ab3698f2b869862cff5a6cabdac5e
- Size
  
  255KB
- MD5
  
  64f88553c102da951f0061dfbf9a9ef9
- SHA1
  
  f78f13cc1f563b23a955034e5a5994cd8e67a26f
- SHA256
  
  453223fbd18b80abfcb0bf4af85a78270b6ab3698f2b869862cff5a6cabdac5e
- SHA512
  
  8b347b28b2be2f5ed3ec0ee6a7e859c2bd05888f0169efed1258f968ae15eec4cd694b83021962c4464ee71af3ca4f3d0f86139f390bebd4db321e65762ab757
- SSDEEP
  
  3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJo:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2