General
-
Target
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272
-
Size
30.1MB
-
Sample
221125-r9lwsseg98
-
MD5
3717a1cc9c3aced10b9f6dce24e00ea5
-
SHA1
0b07785d4e72993e1459edd498091ac1f0250e01
-
SHA256
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272
-
SHA512
63c765884230989c4917230ae14c61992ee6d8deb9f28adf057c2afa24e7ba2b9c1c47cb6b522b05c5674e2e151b4df78a00ba59e6e4de287f668c33598b12be
-
SSDEEP
786432:DH22j0SJs237EEmAHS5lmqLKJp/R6nPzyWp/8dDfLy4Wt:7Twf237Eiy+qgfQuGUdDfLzO
Malware Config
Targets
-
-
Target
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272
-
Size
30.1MB
-
MD5
3717a1cc9c3aced10b9f6dce24e00ea5
-
SHA1
0b07785d4e72993e1459edd498091ac1f0250e01
-
SHA256
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272
-
SHA512
63c765884230989c4917230ae14c61992ee6d8deb9f28adf057c2afa24e7ba2b9c1c47cb6b522b05c5674e2e151b4df78a00ba59e6e4de287f668c33598b12be
-
SSDEEP
786432:DH22j0SJs237EEmAHS5lmqLKJp/R6nPzyWp/8dDfLy4Wt:7Twf237Eiy+qgfQuGUdDfLzO
Score8/10-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Sets file execution options in registry
-
Sets service image path in registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-