Extracted

• • Target

    Kaspersky.exe

  • Size

    93KB

  • MD5

    3060fc299e17c7783df72a4e5f031f39

  • SHA1

    2b1a867cf9dd435670d3c638974b4ad3c4a6ac87

  • SHA256

    cc3766508cfe6674d7c5a3008353ad24aa7e50c576a77b31e26985bd7aee5aa0

  • SHA512

    490a2728a54d021e2834332b8a1cc37475486794a2eef27c974a587ede72e1ca4672e3d0f05c646c954f4f4760c12a13f9cd901b816436ca20690ad14f904aa2

  • SSDEEP

    1536:HV/r7EkrjaFIs7E5OxzJn8njEwzGi1dDjDzgS:HV7jau5OVVLi1drs

  Score

  9^/10

  defense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1