4f1dd5676d5172e4ea67cb6873c490d8a2e0f7d9fdcf864aa725abc1f445419a

General

Target

.
Size

153KB
Sample

240425-n8v7asae82
MD5

12db0a52e50024e6788c56c9b9e9e2b8
SHA1

9ab805090d66da7b19051c8963798d0b5b70fb0e
SHA256

4f1dd5676d5172e4ea67cb6873c490d8a2e0f7d9fdcf864aa725abc1f445419a
SHA512

681196014d2eb9c6d4e339d697d0f622b9b40aca3759ce145357f1a19df8e82cb9868b6fb8e0c0e1f85f2d664bdf9b3bc20769de9bc67307e96383d2aa02eb59
SSDEEP

1536:o1kEyp2d8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllV:wkEypXL6WVMllhAYyHhqiS

Score

10^/10

Malware Config

Targets

- Target
  
  .
- Size
  
  153KB
- MD5
  
  12db0a52e50024e6788c56c9b9e9e2b8
- SHA1
  
  9ab805090d66da7b19051c8963798d0b5b70fb0e
- SHA256
  
  4f1dd5676d5172e4ea67cb6873c490d8a2e0f7d9fdcf864aa725abc1f445419a
- SHA512
  
  681196014d2eb9c6d4e339d697d0f622b9b40aca3759ce145357f1a19df8e82cb9868b6fb8e0c0e1f85f2d664bdf9b3bc20769de9bc67307e96383d2aa02eb59
- SSDEEP
  
  1536:o1kEyp2d8LonVJoqYarK4DsYNgRyypRMPuNPV5nPztP4FPfaParP8R4DJ2PWTllV:wkEypXL6WVMllhAYyHhqiS
Score

10^/10

adware discovery evasion persistence spyware stealer trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1