543d09f282d15e773c40af1755c0b496d73127e24e4af5f6860f2c351e5ebcf5

General

Target

BetaGameTester_MALWARE_DO_NOT_RUN.zip
Size

88.1MB
Sample

240825-rlgl6sycme
MD5

0af629df8eb8475dc77da9212e43d405
SHA1

e043cfe548cbbbb8c250d2fbcc1f550c508b19cf
SHA256

543d09f282d15e773c40af1755c0b496d73127e24e4af5f6860f2c351e5ebcf5
SHA512

300a5d8572c09d850b4797e5819372b86ad1babf83d319cbcc2c93703f87bff4f0a28928685bc78f3a032693dfc9d6d2736f6bc307d919937b18d43a9cd498dc
SSDEEP

1572864:Dz4SqHRfB7P31Pb2yDnADSZldL+JnV4ZpLdJrZGKfxdpWc5Jr5Ejp2Un1Cvirm65:DMSqfoyDnAOZvLweL/dGKxn5R+9noKh5

Score

9^/10

Malware Config

Targets

- Target
  
  BetaGameTester_MALWARE_DO_NOT_RUN.zip
- Size
  
  88.1MB
- MD5
  
  0af629df8eb8475dc77da9212e43d405
- SHA1
  
  e043cfe548cbbbb8c250d2fbcc1f550c508b19cf
- SHA256
  
  543d09f282d15e773c40af1755c0b496d73127e24e4af5f6860f2c351e5ebcf5
- SHA512
  
  300a5d8572c09d850b4797e5819372b86ad1babf83d319cbcc2c93703f87bff4f0a28928685bc78f3a032693dfc9d6d2736f6bc307d919937b18d43a9cd498dc
- SSDEEP
  
  1572864:Dz4SqHRfB7P31Pb2yDnADSZldL+JnV4ZpLdJrZGKfxdpWc5Jr5Ejp2Un1Cvirm65:DMSqfoyDnAOZvLweL/dGKxn5R+9noKh5
Score

9^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1