Extracted

• • Target

    2b76fb1f92833f9bdec15d5b6df8dbef946a554ff1c0db214e0bc14c1e503442

  • Size

    172KB

  • MD5

    e0e106aa3adc8d2a12e1bfeda48996f2

  • SHA1

    4750e04a8622e3cd246122253182eb094743a2a5

  • SHA256

    2b76fb1f92833f9bdec15d5b6df8dbef946a554ff1c0db214e0bc14c1e503442

  • SHA512

    a2ef36cd5a73d412f1c66b557417458846d6849c2e2e39a404c680f67ee999dc6cca0f9d148b0f5df141e08977c6c3f4aedf095bed2517c79ed12abc473da599

  • SSDEEP

    3072:iHwrxmMpvDITZg1SO5GWp1icKAArDZz4N9GhbkrNEk1xr:9rMZAp0yN90QEe

  Score

  10^/10

  executionpersistencespywarestealerupx

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1