806740796d3071184023fd7e9f3ef3f9aa5c19456b5dbcfce22f03f98a37b848

General

Target

SkySpoofer.exe
Size

83.0MB
Sample

240921-cfkz3szejf
MD5

482f2df813588eeccf1a168faf02449d
SHA1

b13831e78dcc84debc5e87c565d75c57654d40f7
SHA256

806740796d3071184023fd7e9f3ef3f9aa5c19456b5dbcfce22f03f98a37b848
SHA512

7fb6594c4aaa861e68d2a38d21670881edfeb56e50ada7be57a8eae9c1d0c02da78e724a237376af792f3a4a15bdc410a06fdc2f3a2caed77d2681ca0e7b8d18
SSDEEP

786432:y9eU7SQqMoknvNpA+vIlo0FdGgvQJbTiumfSM2ocESWqEIBBqWMNWHXEF:EVeQqMrlpA+Ql45xTivfSIfqrBBJH0F

Score

9^/10

Malware Config

Targets

- Target
  
  SkySpoofer.exe
- Size
  
  83.0MB
- MD5
  
  482f2df813588eeccf1a168faf02449d
- SHA1
  
  b13831e78dcc84debc5e87c565d75c57654d40f7
- SHA256
  
  806740796d3071184023fd7e9f3ef3f9aa5c19456b5dbcfce22f03f98a37b848
- SHA512
  
  7fb6594c4aaa861e68d2a38d21670881edfeb56e50ada7be57a8eae9c1d0c02da78e724a237376af792f3a4a15bdc410a06fdc2f3a2caed77d2681ca0e7b8d18
- SSDEEP
  
  786432:y9eU7SQqMoknvNpA+vIlo0FdGgvQJbTiumfSM2ocESWqEIBBqWMNWHXEF:EVeQqMrlpA+Ql45xTivfSIfqrBBJH0F
Score

9^/10

upx credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2