370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

Sharing

Copy URL Twitter E-mail

General

Target
windirstat1_1_2_setup.exe
Size 630KB
Sample240229-2ejs3aec91
SHA256 370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd
MD5 3abf1c149873e25d4e266225fbf37cbf
SHA1 6fa92dd2ca691c11dfbfc0a239e34369897a7fab
SHA512 b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e
SSDEEP 12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  windirstat1_1_2_setup.exe
- Size 630KB
- SHA256 370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd
- MD5 3abf1c149873e25d4e266225fbf37cbf
- SHA1 6fa92dd2ca691c11dfbfc0a239e34369897a7fab
- SHA512 b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e
- SSDEEP 12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 7e08cb4ff81dbb0573c672301681e31b2042682e9a2204673f811455f823dd37
- MD5 9b2ad0546fd834c01a3bdcbfbc95da7d
- SHA1 4f92f5a6b269d969ba3340f1c1978d337992a62c
- SHA512 5b374fe7cc8d6ff8b93cfcc8deae23f2313f8240c998d04d3e65c196b33c7d36a33930ffd481cdd6d30aa4c73dd2a1c6fe43791e9bf10bd71b33321a8e71c6b8
- SSDEEP 192:v6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTKK72dwF7dBdcQOz:v6JaVh4I5rpPbTK+BdhO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5
- MD5 4125926391466fdbe8a4730f2374b033
- SHA1 fdd23034ada72d2537939ac6755d7f7c0e9b3f0e
- SHA512 32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008
- SSDEEP 192:4O6dJA/ruAFEiUdWWE6hE5RYUdJfbub1algMO:RKAFERdlxhGRYUzqZal
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $_5_
- Size 632KB
- SHA256 f12d0929055567eee4b5842b7e59c34585a03191447de682dc729ad19aa2314f
- MD5 3f3dd4476249ae664e3365e5bb651601
- SHA1 752e1687d58de3bef927d9ad24c0ed3da3754e17
- SHA512 c9d38fa61fac0f48e8c2bc319c87df31f1ee49e8bc383ce348042480e1f0d0c28f198fbfa8cb6dd62f5767ae51ce8e67a7f527213fe1043987add465f1ba97df
- SSDEEP 12288:5nKnA/rpVTNPjAuufoRqGKRsytFTkzpjSp+Km:InA/zTN7AvfJGAsuTkzu
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Uninstall.exe
- Size 46KB
- SHA256 afc864cfce79b2a6add491a27ea672d958233ed7a97a2cbbce60100d2fa1e670
- MD5 a127e6118b9dd2f9d5a7cc4d697a0105
- SHA1 9ac17d4dcf0884ceafacf10c42209c0942dfe7a8
- SHA512 0e57d2856c02c55d477d9b3cc1d4bf5ffa3650d4b20be18b0a9e614d19143aee325c4cd92ff31bbddf6e93cd3ebeb47d8727de6e25faa366341cc71117122065
- SSDEEP 768:tnCHBjSfD0RDSjiN+WWrHcRtf55M4z54q+F5871mJMOUlNu0ZBA9U:MHFSfARDSW0HefHbmJZUlNu0bP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 6692bd93bcd04146831652780c1170da79aa3784c3c070d95fb1580e339de6c5
- MD5 4125926391466fdbe8a4730f2374b033
- SHA1 fdd23034ada72d2537939ac6755d7f7c0e9b3f0e
- SHA512 32a1cf96842454b3c3641316ee39051ae024bdce9e88ac236eadad531f2c0a08d46b77d525f7d994c9a5af4cc9a391d30ee92b9ec782b7fb9a42c76f0f52a008
- SSDEEP 192:4O6dJA/ruAFEiUdWWE6hE5RYUdJfbub1algMO:RKAFERdlxhGRYUzqZal
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  shfolder.dll
- Size 22KB
- SHA256 e69da5febb5a2932cbe731e32a5d7f6615bb987a119ef2cedead4555d86144e8
- MD5 33c369a535290299ed5e5167cea37fdc
- SHA1 4ea387cb55cada35de02738dfb324ab830d416f4
- SHA512 581f2bf315c90e200fd621477d0192c6b3b4c51575b9d9f8c85114783c4425a7de221898055aa275068e4c6c5fb0458eb13a66b4512cc7499e7cc7843aaf9e78
- SSDEEP 384:kqXjRYAhfBALfdpju122HoSHigH2euwsHTGHVb+d3HmnH+aHjHqLHxmoqQG0CHuz:kWjRLhZAL7juAL4+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  wdsh0407.chm
- Size 54KB
- SHA256 181a23a56b7649d5e1c882786de531fedfb9e80a58c96ad92871f72a626eac14
- MD5 64aa305e920630d0f813691f4187c496
- SHA1 4bbc9397c16de7cd9869252632fe038b8f8ad384
- SHA512 fde86a9a5b55756371af0d4bbb7a0b542b9765503657368540a651d153f84359fdb75522331b7672a0c242c107765e5c0ce717f60b18ff8b1bd2ef5aee44351d
- SSDEEP 1536:EN2/oYDyp7DUWsbIxXXVP2sQoizOut88vS:O2wYDyuWsUxHVP2sQoizJ88q
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  wdsh040e.chm
- Size 57KB
- SHA256 8e54bc2dd576d4bfe241e37305a525d80fd9839ed0de2e34abedf49c7f23f5cf
- MD5 bc90b966e06c5c20486815809606c77d
- SHA1 12d7ba627d77187c1a41b552ab3c6556ba4a4823
- SHA512 26047532e3d6c495dc6a7b0c8d0479018227c189f1c0228ea83a209b5422ac88188c9e9cb7422ec02fc8c9dbc0ac3ce2588a62d8648fde616b9cd61b85a155b9
- SSDEEP 1536:V6iw3SziWVuxJ16cuZ4GMFtoEOq6YShAvLpAE/Q:IiJ2uux/6cuZVG/6lhOqYQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  wdsh0415.chm
- Size 55KB
- SHA256 bab7db85927f846a6ac584d5fc3fb522e812fc1e505e333728f85efd16b50238
- MD5 de97a75cfa6d6cbf91ba68c0c90695c1
- SHA1 5932fd0fadb6ef284605e2410b5045dcc131ac93
- SHA512 7714be7430c309d2b63dfd1e90446925f417ee500b06350f595d43b9c0db121339151ea7e0440922dd6c11534e23572da3d2c9d31dc21c808a8a840ec8e0f172
- SSDEEP 768:kb69pw0scpr+Mo4OiKvc7DqL1hjzZwAsGHJLg9KM9G/b0/P3eubAHOjDIhR7Iop/:kb6Xw07XXq9umATqMeWAHqvYnFHt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  wdsr0405.dll
- Size 56KB
- SHA256 7463df064c98cdb501b2310dcac878f9210a303d50d79431152e3031ae1a224a
- MD5 8eee4f1cde4b0cfd0365456040e05364
- SHA1 b38200f4a3af27a59ec08fde2c6aaac4727dffbf
- SHA512 17da577977c6766dc56ee08726ae77f4cbbf83da1037c976d8ca36c7149bee56fd691ab735fc4a12721d86860fddc39ff99bb74aa515de96bd2da0596fbd33ab
- SSDEEP 768:yOWz6n36MwlqZT5nNAPxIkRXIafTGO6kRfw/WZaKCam:yVSBNoSkRXIafqjkRf4QCam
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  wdsr0407.dll
- Size 60KB
- SHA256 7867b69c5deff7f949e58eb3ff1b266e66ad3fd252c52334927114e7c53ce27b
- MD5 619767bb217f6d1754e018926753e89f
- SHA1 cb731df1d74ceec090cb55fb76e9dfd6e4337400
- SHA512 8bb7c717206a3b86bf4c5d46d0a838373ae557708040656f9c2cb47db5f38165bb9160545d2f6d9200b9ff59160292f88044abd997bcc01e46b40a4dcf58318a
- SSDEEP 768:QniT9wgpxcn37TFb0FuIa955yo7evokJrOLoZaKCam:QnbgpsLt4uIa95h7evokJr4OCam
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  wdsr040a.dll
- Size 60KB
- SHA256 75ca96992380e5b8e323310a01c8a68805ad76223197d2bdaecc03817d233dea
- MD5 cf69ec4f622ab3efc0d59c94c7861d3c
- SHA1 8baa748295cb941e1693e4c2a298343fbfc5c048
- SHA512 dcc99395fed596e6ef7a959731254093e73fa006a14b0ecbe6f780a9d8236428d9e90024e016d5f1bdbf323e1fe01ffa3727c9d09a8666ef2745dc56462ed6cf
- SSDEEP 384:jH6u7Vn2KDadkOKDVdS9Ew5eNC1GF8wcgnSLIdOpAv18/pIaqSivHxACkwYcwiZY:HxKQ8wcgnSQOi16IaavWiZaKCam
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  wdsr040b.dll
- Size 56KB
- SHA256 d7fb9404282ca467e0f3e80734a388885c219269d3e9ee78bb66ee9201803ae4
- MD5 4a5a97171af49b09f1c68ba7a9bdae34
- SHA1 a6ed7e9ed8a4d9b462378571346fba1d40f1c75a
- SHA512 51a0f250cbd115f532970a291ef477de89cff786df28ee8729d35f68c8cb0f018a58e9edbaf758ff11172b68952f8fe3b74ff8ca6e8e62a482712126ddd40323
- SSDEEP 768:ne1K36pwrqnfPAY5IaBNqhN+3ATwZaKCam:ne1oAQY5IaGqXCam
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  wdsr040c.dll
- Size 60KB
- SHA256 acd0c6b92acb5793a94e820c4d418bd6114c97fe2b9788de73879b8bf220a717
- MD5 ed8a32ce3b4edbd63b6ed2b6d5ff5d5a
- SHA1 ebb687857dff99fecc532e254445a8f3abb89e6c
- SHA512 8b3d9a9d0c684c4b1563abf9c65e511e0b42ac0161e9d4ea811fbee2beed05ece24450f4c997294ebb8330f2ead6688041c8ba528889205ec93ffb50fc8671e9
- SSDEEP 768:uQWoYnbSwuHmnfPhckTBfIamFUseyqTj4e1ZaKCam:uxNHx9lfIa1Cam
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  wdsr040e.dll
- Size 60KB
- SHA256 3bb682f3088fac19c4d53b3766a3793630ea19d2be33cb0f26f7f9e5972dc221
- MD5 08b9dbd8b49783f4d04f9ed4b1ecefa7
- SHA1 76852aae0722e20e21e67b2fb27f2ff70d5a1f87
- SHA512 429201eef6b9c40d3330345ce2765e8038f488d90bcbf2b315d365f370d00ba2be7b245492b42dadbc220ce464f9b64b1985d4f958e4c9d26aacbd8b854b9c0b
- SSDEEP 1536:jxuBkbqIfOtIa6BJjQ8wDl3Di5c2m5CuCam:NuBKqIfOtIa6BJjQ8wDl3Di5c2m5CJD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Reads user/profile data of web browsers

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32