538dd553c5c9e064cbdea35488d231a5ac1a269971c10ff9edd832ee4c3831d0

Target
MegaBoy.rar
Size 453KB
Sample240325-2xmbxaae95
SHA256 538dd553c5c9e064cbdea35488d231a5ac1a269971c10ff9edd832ee4c3831d0
MD5 a0c7af86bb764c513e635c1f63ba8c24
SHA1 af1e6429e73e72a2f166d93903204ffb632c5280
SHA512 ba288ca1d1ec7ac72fb7fbf6d3a7622c5314278137cb09853db5dda5b3b0fab84db6ca2283816c518d0c0a02f5e3f1259cba64acb3e13313264509c1fa00a510
SSDEEP 12288:++mCf65YbGv9r8g/8VzZDPCJ6OISXXZBy1BlT4:+2fBbG5/8VzZDabfym
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  MegaBoyNVM.exe
- Size 741KB
- SHA256 12666e89946c921a38d0450bac578d2f7ad27355c8637d332a5caaac219e6dc0
- MD5 407f44976e706ed5cd320f895cf5e27d
- SHA1 92157fba5a984e3604c81fd658803bdd22c8c8cf
- SHA512 84756dd53f0b74c87a8f1ef2eaa8455222ba85276dce021b49c33046780a5295951347ed38ffe6b2d3041e05ce79f83adcf74e0c13b6c248acb80f3cbde5b494
- SSDEEP 12288:G4VFFJXKMkPVle8m7O5gdltr+9yv28HA:bFJ6ME5Ei+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  MegaBoyVM.exe
- Size 102KB
- SHA256 8a16e748ca24d7f8a5205501fd381cef33c6bbbb2e715abf6b91f486ad6afd2d
- MD5 f0de1a04aa9ee6d1e8d6fb391ce10034
- SHA1 e0ccf4a81f920997b5f2dbb7209844491e774647
- SHA512 12818c13cb4084dcfdf0c804ef95eb0c131d71a2ddc1323eee35dbf1848f140bbd24f6e5e6265629eabf5de46ae8cb2e74eb42016e285dbcef7314e4063fe5ab
- SSDEEP 1536:3yU9NZjogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCB8u4jx9bSHACiH:CwNeN3w/jhlhE1Z8Nig9L8u4N9bSE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery evasion persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Disables Task Manager via registry modification
  evasion
- Disables cmd.exe use via registry modification
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral2