General
-
Target
file.exe
-
Size
13.7MB
-
Sample
221127-t5yqxacb57
-
MD5
6ed9213230f84121eec74a51f490b3c4
-
SHA1
a0cad759ed65217508cf3aba0ed04939cda38a08
-
SHA256
5473cd2b9eb5b9fd9bc03e4a4e8f49818cfb8dcb94912946fee949a9536b5013
-
SHA512
cbeadf5faef8a32025ed2d722c53c382bcea824023b0400384bf7bc3a1aa0b7c21e53b7e573c29ab110392470c2d214afbd838a8bceb50f2461eecaa1c6f0385
-
SSDEEP
393216:uFwKNWPAIAOUm81SyI+fx4PcO2VQkGXs08Z:MKAy18MofFONXiZ
Malware Config
Targets
-
-
Target
file.exe
-
Size
13.7MB
-
MD5
6ed9213230f84121eec74a51f490b3c4
-
SHA1
a0cad759ed65217508cf3aba0ed04939cda38a08
-
SHA256
5473cd2b9eb5b9fd9bc03e4a4e8f49818cfb8dcb94912946fee949a9536b5013
-
SHA512
cbeadf5faef8a32025ed2d722c53c382bcea824023b0400384bf7bc3a1aa0b7c21e53b7e573c29ab110392470c2d214afbd838a8bceb50f2461eecaa1c6f0385
-
SSDEEP
393216:uFwKNWPAIAOUm81SyI+fx4PcO2VQkGXs08Z:MKAy18MofFONXiZ
Score10/10-
Modifies system executable filetype association
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Registers COM server for autorun
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-