932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9

General

Target
932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9.exe
Size 413KB
Sample240607-cgk2gagh86
SHA256 932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9
MD5 732413351fefa0a8069912c0d1325629
SHA1 729457db072fdf2ad63772180358183c98dc6c87
SHA512 8e85435f009dec802e5b5760a491449c5b08669064af9ca49a1a36801e26870d4abb1012feefdd2c419689e54457ff89042b50ff487fd102f7295ecd9b403de5
SSDEEP 6144:YwrvOkgBWZb4JhMOLAPfoxo9qxkNFMhidSv4AnQX15oVnm8K0I:pOkgBWR4HMYgfoxo9qO7I7WDImPr
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9.exe
- Size 413KB
- SHA256 932062a2b5551bbd3bfd56e5bd96891cc6a65363ea05c197aa9b950e45b9dca9
- MD5 732413351fefa0a8069912c0d1325629
- SHA1 729457db072fdf2ad63772180358183c98dc6c87
- SHA512 8e85435f009dec802e5b5760a491449c5b08669064af9ca49a1a36801e26870d4abb1012feefdd2c419689e54457ff89042b50ff487fd102f7295ecd9b403de5
- SSDEEP 6144:YwrvOkgBWZb4JhMOLAPfoxo9qxkNFMhidSv4AnQX15oVnm8K0I:pOkgBWR4HMYgfoxo9qO7I7WDImPr
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

collection persistence spyware stealer
- Detects executables built or packed with MPress PE compressor
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
- MD5 fbe295e5a1acfbd0a6271898f885fe6a
- SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
- SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
- SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4