7b8c0cdbbef7a4486fd8dfbf0ce163a68ee797418f78a375b716dd64e313e352

Target
slinky crack.rar
Size 32.2MB
Sample240616-brrfkatcng
SHA256 7b8c0cdbbef7a4486fd8dfbf0ce163a68ee797418f78a375b716dd64e313e352
MD5 2877d2d3e68db2e82a8bc92c694eff20
SHA1 108125043c6064b6e0629c0a9c77596fb088b925
SHA512 e3df7f3043d50718cde9017ac20b130dc47d50534d6aa6dea528ac20a9d315f5f93177a0730257c6b942d039f458ebf6a1aeeb148afb49bb7a5dda4f46983898
SSDEEP 786432:qpTRkoJBKzqtd7nDB0E70RD/BSO/WO2Pcci1El6r8nVs1g/sfl73+f1BBb1CzjA:qpTRkoJB/37D67JSxhHznVCg/sVi7bKs
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  slinky crack/loader.exe
- Size 84.0MB
- SHA256 4f4f8bfef2fa77ce873a42adab47b4ce0d8150f4c59d09ecc044793c9400dd49
- MD5 8849a8881df71b7e3b78d0ead67fc2c2
- SHA1 d98e8d03c0bcddf4b3b10aa87908b47212f7d3ef
- SHA512 656757398b8f87e2a90a0962f2c9f02447ceb203ce717ca84f438ca7108cf3c10209d71746096246797f9942da3eccafcc1d61a726fcbd6ec900a059caafad20
- SSDEEP 393216:sjAPfF3dNPVLCEDLQzH2ciIrHW4H//o3BdUMK1gC9wN:oAjLCEDLQzkIL7/wjUBgC9wN
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  slinky crack/slinky_library.dll
- Size 18.1MB
- SHA256 16745ae6670eba8a452a5e75fa6142564d31bd3b7d14766e04f1acb214f65703
- MD5 44b5e89a9f7bab889a4df60042872f17
- SHA1 cfc40cd4fdbda75d3ed52952c500d8ccc12f4a36
- SHA512 7f18545da3e4fa726ec33345f7dc137eedf4961a1bd0582b51ee2258a6d5a115187a4e72ec3c7b6d29e33b0a4aa2560adec1833b4bda3f00a7b194ea71d95188
- SSDEEP 393216:kKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:HANWKRrpYrNvou7NK3uU6E29dPL
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  slinky crack/slinkyhook.dll
- Size 228KB
- SHA256 7c4234fac3b6b3e96dace1e71c7a952ec67e3839f90f7a88a9ea283bf88d25b8
- MD5 6d8c17c67970cb5841811eed8adffffc
- SHA1 c869ab32318a035e51aff8e5e11b4cd25fb52a4f
- SHA512 7d2a0ffcd72c8bf4a96b2ed722d7119749ec14f5d7e6a601cb6ae4a5b1c4a652b694158f01da340e3ca4751cabd0a56c42bf739d8b421e36937f3691b3b80c72
- SSDEEP 3072:hXxN1I6PgabbAzVxPLI5oIa5amK/1o4ptgELHY1lNyc+m+e7P26g66OVuknsDe0u:hhN1GFZq/15tFc+m97ieuknsDu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6