9d84579a8ef038b25ad305a1109d0b00ae98a4fb23e7de01753697843f779983

General

Target

DeltaLoader.exe
Size

44KB
Sample

250205-wc29qsxlat
MD5

50197e452db64d2f815c89ccc3205a29
SHA1

ae614db915c947b4d59ffad9c70f30796746f9b9
SHA256

9d84579a8ef038b25ad305a1109d0b00ae98a4fb23e7de01753697843f779983
SHA512

366ca9fd72578fa78ca87bb5988854d5c0504307cc02cb0169aac089220981f27f52031547a4aa4a1877585802963141e1454ab542a3c7d68531708d8ca54cde
SSDEEP

384:mtSEAIdjiPyK0aq3v3qyMyc0nhjS5Bw5mwMl9eLKLkTQC9LWQyyLnguBih5:KSnIMHjqiecWBCw5NQMekTQ2yqnguy5

Score

10^/10

Malware Config

Targets

- Target
  
  DeltaLoader.exe
- Size
  
  44KB
- MD5
  
  50197e452db64d2f815c89ccc3205a29
- SHA1
  
  ae614db915c947b4d59ffad9c70f30796746f9b9
- SHA256
  
  9d84579a8ef038b25ad305a1109d0b00ae98a4fb23e7de01753697843f779983
- SHA512
  
  366ca9fd72578fa78ca87bb5988854d5c0504307cc02cb0169aac089220981f27f52031547a4aa4a1877585802963141e1454ab542a3c7d68531708d8ca54cde
- SSDEEP
  
  384:mtSEAIdjiPyK0aq3v3qyMyc0nhjS5Bw5mwMl9eLKLkTQC9LWQyyLnguBih5:KSnIMHjqiecWBCw5NQMekTQ2yqnguy5
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1