0380f87c00cf7560af3cf0516ce171ee33fa8f3d6b1b403e041320d5d70a0dae

General

Target

0380f87c00cf7560af3cf0516ce171ee33fa8f3d6b1b403e041320d5d70a0dae
Size

109KB
Sample

221203-gpv9maea8w
MD5

d3cf85e9e86cf715e17bebd2815293d1
SHA1

b0fae70548f2e79ffc37b6d8cc2c86e548514fa9
SHA256

0380f87c00cf7560af3cf0516ce171ee33fa8f3d6b1b403e041320d5d70a0dae
SHA512

7c498a925b5337293fabf319645c117fb5160a935eb94a2b7babffa26e7d41a2c5024c1a1cf552962914dc82ccbc01ae19ee9592eabdb02bf6aa194fe6604952
SSDEEP

1536:AaKBPMrRyJVy9H4jN9cotLJo0XpAfTaU9v3nXXUr9WuXKrNgHCv8KG2ej+4sw:9KNM1yi9YjrtSGpA7JvnXnu4GF6y

Score

10^/10

Malware Config

Targets

- Target
  
  0380f87c00cf7560af3cf0516ce171ee33fa8f3d6b1b403e041320d5d70a0dae
- Size
  
  109KB
- MD5
  
  d3cf85e9e86cf715e17bebd2815293d1
- SHA1
  
  b0fae70548f2e79ffc37b6d8cc2c86e548514fa9
- SHA256
  
  0380f87c00cf7560af3cf0516ce171ee33fa8f3d6b1b403e041320d5d70a0dae
- SHA512
  
  7c498a925b5337293fabf319645c117fb5160a935eb94a2b7babffa26e7d41a2c5024c1a1cf552962914dc82ccbc01ae19ee9592eabdb02bf6aa194fe6604952
- SSDEEP
  
  1536:AaKBPMrRyJVy9H4jN9cotLJo0XpAfTaU9v3nXXUr9WuXKrNgHCv8KG2ej+4sw:9KNM1yi9YjrtSGpA7JvnXnu4GF6y
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2