General
- Target 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236
- Size 11.7MB
- Sample221126-e42c3sca48
- SHA256 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236
Score
9/10
Malware Config
Targets
-
- Target 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236
- Size 11.7MB
- SHA256 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236
Score9/10ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
Executes dropped EXE
Registers COM server for autorun
Sets file execution options in registry
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.