2bde5ef21d7bdbcf7ef622f4eac91bec776875dd5b0bd5d52b41d2db4cf04400

General

Target

TOOLS.rar
Size

15.6MB
Sample

240801-zzyrlswflq
MD5

6c3c216b24b1fd3caf7d6aec18c5704a
SHA1

7012b86c953325a1f1c3f69b13a8f3dbcf95d829
SHA256

2bde5ef21d7bdbcf7ef622f4eac91bec776875dd5b0bd5d52b41d2db4cf04400
SHA512

34c0e83599f0be0964e1b7ded6cbff66354da7fa79b180a11a7c303edd49270cf625284ff84a9cf499614966a5bb12fa1d572f12c974d8cae8e643743898bd05
SSDEEP

393216:2xMCfed8gtMqb3Y//bNzDK/nhS8F0tEp98SSeTpWlHtg43bRmvd:ibE8gtM4YHZzDonTpWxVbEvd

Score

9^/10

Malware Config

Targets

- Target
  
  TOOLS.exe
- Size
  
  15.7MB
- MD5
  
  09977e752efb440d5254d763821229ee
- SHA1
  
  6893f9b9ad20cb7604a1f2edceb411123dc47fc6
- SHA256
  
  4da7c57da36f317504fc1fa73b252d4d4ec8b67cafcf9fde0ef997d2c2e65664
- SHA512
  
  291bf5bd25ae952b16a313c8614e5d9d8e4695b522ce8458f84b3b9673931d40d5650b986d54d6c2e6470b21890667186917bd84336519398ada207887548e4e
- SSDEEP
  
  196608:0gYIgMmSQJ0sKYu/PaQZXGnDzwmJb3tQk5tIDOAWJlpZstQoS9Hf1DklKXqb536c:ih9SWQZXG37v5tI9gGt7G/I5Kfl3mh
Score

9^/10

upx collection credential_access discovery execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2