dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df

General

Target

dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df
Size

1.6MB
Sample

221129-qlxgysfb7x
MD5

aea89e584baa3cdb4bc42f62f798ac5c
SHA1

126024decb74c300579bb844451e6a17a383d6f0
SHA256

dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df
SHA512

6faa1eaefa08f0c71fd40ce6e4379a28d8211aa53ed755d0d9106a15dce4252b7c67d80a3d5a0a379262462c2c43b97223fe2484fed0de69b77729bde0eb299e
SSDEEP

49152:nYqRvbfHLZW2Uf9SLukd3W0C1dySncCZ8W4z:/RjlW22ULuiW5xcCZEz

Score

8^/10

Malware Config

Targets

- Target
  
  dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df
- Size
  
  1.6MB
- MD5
  
  aea89e584baa3cdb4bc42f62f798ac5c
- SHA1
  
  126024decb74c300579bb844451e6a17a383d6f0
- SHA256
  
  dc21e0e1092e35eb793f8dcd8d7c92166819d7081d9db4c2530d3a8522e143df
- SHA512
  
  6faa1eaefa08f0c71fd40ce6e4379a28d8211aa53ed755d0d9106a15dce4252b7c67d80a3d5a0a379262462c2c43b97223fe2484fed0de69b77729bde0eb299e
- SSDEEP
  
  49152:nYqRvbfHLZW2Uf9SLukd3W0C1dySncCZ8W4z:/RjlW22ULuiW5xcCZEz
Score

8^/10

aspackv2 discovery evasion persistence spyware stealer trojan upx
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Program crash
- Drops file in System32 directory
behavioral1 behavioral2