5e681eeb4e55d9b0c88e1515ed06ae368b3e0243273a94eab94f38b483485ae9

General

Target

pw1207-free-online.exe
Size

3.1MB
Sample

230103-yj4ggscf98
MD5

26684efa2d1a2154a56fc36438b94b62
SHA1

32f155c5716a2b068f6526eef6b37ec28ecce1bd
SHA256

5e681eeb4e55d9b0c88e1515ed06ae368b3e0243273a94eab94f38b483485ae9
SHA512

d5fc6be6b95e5cf6ca524b7c6fc6464c57b0d13b4031498b27ddde02b5258674ecc53f8df561e9a5c935debefd78e837340504b8053b09d2bac0d5092b493558
SSDEEP

98304:VkL2991YnIbfnLTccGEE7kc7EFnGQYy+9E:22991OIDtQIc7EFGQYNE

Score

10^/10

Malware Config

Targets

- Target
  
  pw1207-free-online.exe
- Size
  
  3.1MB
- MD5
  
  26684efa2d1a2154a56fc36438b94b62
- SHA1
  
  32f155c5716a2b068f6526eef6b37ec28ecce1bd
- SHA256
  
  5e681eeb4e55d9b0c88e1515ed06ae368b3e0243273a94eab94f38b483485ae9
- SHA512
  
  d5fc6be6b95e5cf6ca524b7c6fc6464c57b0d13b4031498b27ddde02b5258674ecc53f8df561e9a5c935debefd78e837340504b8053b09d2bac0d5092b493558
- SSDEEP
  
  98304:VkL2991YnIbfnLTccGEE7kc7EFnGQYy+9E:22991OIDtQIc7EFGQYNE
Score

10^/10

adware discovery persistence spyware stealer upx
- Modifies system executable filetype association
  persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1