70baa8e70a1cd473bc5154fe56f645f50b286ac6123335be8562169fce55aec2

General

Target
o1cu68.zip
Size 68.9MB
Sample250120-rcvsfaspfr
SHA256 70baa8e70a1cd473bc5154fe56f645f50b286ac6123335be8562169fce55aec2
MD5 c8acdea2089d82c590054d3f5613f368
SHA1 47650c322608d692d58d3118646dd15a0018752f
SHA512 c2042b0505b79119f6c046dc7cf644207adedb2724a4acebdbdc95d90de5113567346fefb43128746a00cca2f812a3d69a4e4aeb22e077bc0de7f6049142084a
SSDEEP 1572864:VCOGQsUszAg+uPygTGKeAnRbl4pp7SiSYQTjH1zVaXSrVToDvmR1ob:VChxzh76wGJAnV87xSYQPFuSrVUD7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  YozoraOptimizer/Optimizer.exe
- Size 69.5MB
- SHA256 f2b2180d6772a464d11b2b995b32aa940ffe3a614ac0b75fc3dadf3f3630a938
- MD5 1c6ceec9de4831efb52698a906c359cb
- SHA1 96fa8619b252602a9e4d69d0fba0066398af2b0a
- SHA512 a8aec3da27843a1904a4063ef2fa9f5f2160db0a35db9600ee98680cfb2377137114d53bf6e1ba0c8ef4d8419317af22b0b66be4b0644d13c0baaa1698b0a015
- SSDEEP 1572864:t7g1/9Owu3CREVd1AEJ5Rh1+BDDy4gds8KN2BXRhPydNgdCMG9Io7o+:tcwweC+Vd1AY5bADDxgds8NhPMqdVYI
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  mango.pyc
- Size 50KB
- SHA256 e35ca7f82d73f46d118b0b9d2cf2e95470b27c46f2e9016f89699adf40a0198e
- MD5 b784d9bc87fcd7fe5631f4d11a685d79
- SHA1 e66c8d7ea2275c365242940bc078fc119ee57ed1
- SHA512 30a6fd581c24145fa2833c851c72143a6f976ab53f65965082637ca4495bfb499cb95c11fd9224ad51c09852c25e9b1c0c6fd66bf612cfffb3fb5c5ff53ae65b
- SSDEEP 768:BnjdjnrwwL0RKdzOBfeV3K1cELIAGIxangDvYcERX:BpDrlwJe8agDvYrRX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral2
- Target
  YozoraOptimizer/data/start.bat
- Size 49B
- SHA256 a5ce377486710d604357efc559b3516523d4378670127c51b21944235dadccdb
- MD5 70b86431df6e12af93a0c3cd49432d8b
- SHA1 81f3ccffff9b461cb3e9dfcc6e33d21c802c49d1
- SHA512 9f91c77a99c9f1dfc9dad5614fc97521bad8b4d2cf1f77217446d91a962e84f47929228d4b256feeac0b326dfc9fea9a9b71b3f1cc4b11d60cbe62a5ae481c50
- MD5 SHA1 SHA512
Score

7^/10
- Drops startup file
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3