03b8b45f2179a7b2e16d6e1ef1b72f0f3755eeaab95525882d6808a86a76a642

General

Target

xxx.zip
Size

76.7MB
Sample

240903-pv9yzayajg
MD5

b57b7a92a82ad8c464fc4ce159e85e81
SHA1

dc10f4ae9d7be753250bfebc41b1a5836b983915
SHA256

03b8b45f2179a7b2e16d6e1ef1b72f0f3755eeaab95525882d6808a86a76a642
SHA512

b8974e32711258c2d753ac39272df528e030b0dc0a49cf0cbf286370d68c7f7e95afba93c3a816b7cd888715f96f1bdc54b2de4ab21570a3d17f04a24cffadfa
SSDEEP

1572864:V26hFwev2yjmVnnFq/NTc/gl7ZsDQquOJZI0aFxjJcS9b1:V2WK22/VnFCTcg7ykHOTnaFPcO1

Score

9^/10

Malware Config

Targets

- Target
  
  YemozaV21.exe
- Size
  
  76.7MB
- MD5
  
  e1e19e165ab9b5f15dd0f2b82a63d327
- SHA1
  
  e1c092781ac19108d98f5067ef63a544596066bb
- SHA256
  
  f222b3917e62359233f7c1afb4abda7671472116859fcbc39f45ead7928a006c
- SHA512
  
  a2558374ccf361372b47078684ed9aa97d47b67f65b7dfcc9f5d8bc3e033115594a4c0326e498503729ae43fadab2711ce10400c7d343939474515e68267e1a7
- SSDEEP
  
  1572864:y4gPXMorgR79oRL0nwiHxWjU31FsbyemoVvo6s/9ZrASbxw7:y4AcGgRiRwnZxWs1a2ho9xs//Auw7
Score

9^/10

discovery collection credential_access defense_evasion execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2
- Target
  
  YemozaV21.exe
- Size
  
  164.7MB
- MD5
  
  28a22c887c97f91d75895fd9348fbc1a
- SHA1
  
  7acfea67a1527aa41a15949c303388c0c8e5d083
- SHA256
  
  faa882c6edf57be28df58518e81282d6c9935dc29c9b57829a9703dcf59846d7
- SHA512
  
  e4aae0ea84d203c82f4053dc13cb72a2366c3841d7de12a59808a1088583a4b7606b5648b5b826571474e14a0a85ce399b7a271c0b28373c0ba8024b455be03f
- SSDEEP
  
  1572864:BtRb5j0Jo3k4uaSwrkaxMnHo/qVfZanrCfYbmLlEkwPT15+ztDTeNokbaGMZAHmM:BTlBaHTf7x+Un
Score

9^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3 behavioral4