General
-
Target
lll.rar
-
Size
10.7MB
-
Sample
230227-aj929sba93
-
MD5
bf79a7cbc2bc44fd882ae8cc4300fe31
-
SHA1
19e119112ab5bb2592eb7ee60a5f1d0ece49e5e4
-
SHA256
9158ad1b9eebf3ca069c39d53535d5e49bc660eefbc41c1e31fc043aade296ac
-
SHA512
165e9ea40e60cfb5cf180da3f6feefadc35711083fa43248f4e893d964f4862c9d81ef9fce3770a4cd677b5f8d29d4c6cc81ba9f9c1c4105b536a007e9ac53ca
-
SSDEEP
196608:QX8hiWrslWgP60fmWyurytgx1FnjUj7Mcqb/i9ogi0Gpu:C8YggP62mHiyGx1FQj7jMMiM
Malware Config
Targets
-
-
Target
IAS_0.7_ModByPiash.cmd
-
Size
25KB
-
MD5
51ca6cdca9930fec2f7fd69e00c5d898
-
SHA1
c9baaa1b9b28ea0ef12173121f55f557a160fcac
-
SHA256
0f7dbe8c1220b2b31fd8e8ed5af9b42f24b40459f77485f6509354a09eeb554a
-
SHA512
2c77f8a7188e516516088a577c9106d9428a85c910daafccded20e6122a98b3af402c62195fa49ae8a3fa46122435bbe0c88e0d62756c27cb991d97a650ef0c9
-
SSDEEP
192:ewVLk373E1zU0eRBtxGzl5HPmX+BJGITq+EbeIBaXORYhBLi6DE7myO2B0Tt/8ww:E3739dRTsLTu7bQ3UH3gPZ5SAJuuQtP
Score8/10-
Modifies Windows Firewall
-
-
-
Target
idman641build6.exe
-
Size
10.8MB
-
MD5
ca5f2c20b23f553ede744031bcee9240
-
SHA1
e2bb2ef859f224bbc4dee9c09e4ffe6d40e89bab
-
SHA256
f13dff1c73d422e2119092af5c2764ad87e4374852d7e5691fdb448696f71f72
-
SHA512
08f0b6da1a083ca6da8027e07665ae1ec639eb0e28b4aef183501a8efc68591224a8c4f23311099a445f5362d01b69752e3ca2c6a6ee469c9ee3a433618f7d73
-
SSDEEP
196608:4sq5pwrR+j3J3p7CfaohovcWTNOPpSOU4FlK3rjofNx3edZi06H8yQ7D2pe6N:4vi4V3p7waoVgO17Ej03gZJH7KpN
Score8/10-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-