fa9b231ba5ff859c73aed5e3eb99fcc825430645124ebaacad456cc651ef1209

General

Target

system.ico
Size

75KB
Sample

241112-a6rjfazmax
MD5

e80cf44bcfbabe5ed88bc48dcd85b22a
SHA1

f0417a74f5a2af22787e27f1bdad17d3e5d70895
SHA256

fa9b231ba5ff859c73aed5e3eb99fcc825430645124ebaacad456cc651ef1209
SHA512

f618187326c610b7eaae7f76c27fbf44c76c18c81c8c14863c7c9a77d915f01fdaa9ba80f62c550783829a0656c97b8b8a29c5cf3d90db60b60f1fa1cb139eff
SSDEEP

1536:dwKY+PfH+zfCShOOjMo+itmERX++x1V5Np:dOOP+zfRhOWRtbRJ1j

Score

8^/10

Malware Config

Targets

- Target
  
  system.ico
- Size
  
  75KB
- MD5
  
  e80cf44bcfbabe5ed88bc48dcd85b22a
- SHA1
  
  f0417a74f5a2af22787e27f1bdad17d3e5d70895
- SHA256
  
  fa9b231ba5ff859c73aed5e3eb99fcc825430645124ebaacad456cc651ef1209
- SHA512
  
  f618187326c610b7eaae7f76c27fbf44c76c18c81c8c14863c7c9a77d915f01fdaa9ba80f62c550783829a0656c97b8b8a29c5cf3d90db60b60f1fa1cb139eff
- SSDEEP
  
  1536:dwKY+PfH+zfCShOOjMo+itmERX++x1V5Np:dOOP+zfRhOWRtbRJ1j
Score

8^/10

adware defense_evasion discovery evasion persistence privilege_escalation spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1