9f5649515a76da77c4431c4617b4eb1908892a40199639f50280a4af77f229e4

General

Target

9f5649515a76da77c4431c4617b4eb1908892a40199639f50280a4af77f229e4.exe
Size

858KB
Sample

240810-byn9sazclp
MD5

47e0f03c5276aa25e585d4a62b154d05
SHA1

b59666f3a00c665fbdeb817a6ba1787f160c5b3c
SHA256

9f5649515a76da77c4431c4617b4eb1908892a40199639f50280a4af77f229e4
SHA512

dca637d5a67a58627081558d2a97278575bede2d481f2e8cf80686f297e848b802ab5eb59f1ddac8f46ba42eae3ad1c9f4b90591f88ff1cd3b43215e9a9d013f
SSDEEP

24576:23e6uKejk390NbreiYIO+QOXpQAPIl4SqiHZfE8Nhpg:A5dt0fO+QS/PIiLgvjp

Score

9^/10

Malware Config

Targets

- Target
  
  9f5649515a76da77c4431c4617b4eb1908892a40199639f50280a4af77f229e4.exe
- Size
  
  858KB
- MD5
  
  47e0f03c5276aa25e585d4a62b154d05
- SHA1
  
  b59666f3a00c665fbdeb817a6ba1787f160c5b3c
- SHA256
  
  9f5649515a76da77c4431c4617b4eb1908892a40199639f50280a4af77f229e4
- SHA512
  
  dca637d5a67a58627081558d2a97278575bede2d481f2e8cf80686f297e848b802ab5eb59f1ddac8f46ba42eae3ad1c9f4b90591f88ff1cd3b43215e9a9d013f
- SSDEEP
  
  24576:23e6uKejk390NbreiYIO+QOXpQAPIl4SqiHZfE8Nhpg:A5dt0fO+QS/PIiLgvjp
Score

9^/10

collection credential_access discovery execution spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2