c7b24982dd799c591ca65ea0b323eab11f4fa470ebc3180a30eccfd580733845

General

Target

c7b24982dd799c591ca65ea0b323eab11f4fa470ebc3180a30eccfd580733845
Size

27.6MB
Sample

240904-b6b97asfqq
MD5

3e9c1ef7aefe6a80d41377c151489fc8
SHA1

e5518f540969dcec4b26ebd67cf5e7dc57c53082
SHA256

c7b24982dd799c591ca65ea0b323eab11f4fa470ebc3180a30eccfd580733845
SHA512

a8d2d3b70ec8ccc06329510bea76828600308be4bad5893991a3593237714bb62122b5c5417884f7af8cd59c8ec0ee0e2c26eb55801b4c7a683e6cf691adbff6
SSDEEP

393216:kSAkE09KyJ8oITVu/Ig16f7oGYF2pvB+Rp3V8yPFg4DsErxr1WvbHp8crwnl3:NE09mo4Bq699BQK4DsErxrEzCcrc3

Score

10^/10

Malware Config

Targets

- Target
  
  06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314
- Size
  
  27.8MB
- MD5
  
  7ea99740a913fd01ab5b6d630a65f501
- SHA1
  
  fe11a17c1a403d6df28508d576c76ece07cce88b
- SHA256
  
  06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314
- SHA512
  
  29f0f688d920bccc887f70710c3b6b01dd004dbef0c294bc57a46d7c460dc979ddb08a8d3c21df26510cbe3c380dc17dcc43e4fa86dc9d56dd4ff17de2280953
- SSDEEP
  
  393216:CUrTbCVFENlgdkQbaVxN2dAdpN7D9aJtW9dcGMBD2KSedViDKKeLQOshouIkPFt4:CUvRgdjtAd99dfGV6qLxwouZtRL
Score

10^/10

collection credential_access defense_evasion discovery execution pyinstaller spyware stealer upx
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1