Extracted

• • Target
    38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat
  • Size 303KB
  • SHA256 38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac
  • MD5 02e3492ec9f0b6068adee89e025e08eb
  • SHA1 15cdcbb1a619312b6664ac5f1ab938a8a49ba328
  • SHA512 3bdd14e992dd007e86480cb04f609efbeea9741219ee1e64434c97f20f5ed6393600d169e1a852e4fd8b100cdb87813d987651bf90f390ee80c7eefae7d8920a
  • SSDEEP 6144:iOQO6m8Lhoc/qIRM5G2N9e2gqi3Y2h+qFLFlOy2MNf2QuxMLT5H:Njh8GG3RM5h3zHi3Y2JZCAcW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoveryspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    JC_abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af
  • Size 199KB
  • SHA256 abce9c19df38717374223d0c45ce2d199f77371e18f9259b9b145fe8d5a978af
  • MD5 0d20e90382f881116201ac7c9298aab6
  • SHA1 217d943f86ab19cfcab9b34db84807a663e1e3fe
  • SHA512 c99d4f7afdc6b200c41976b30eaf50a78555f6feb0127c79f368b397301f9c98b25da11389da198e540516bc10dec942709848c6ec936a56cb1d4617af820ce5
  • SSDEEP 3072:2yui35przV2uZ7PHd2AKrIeHIlI/E73BXu3Wpiv:KinrRTVKrPiI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agnianecinoshibotdiscoveryspywarestealer

  • Agniane

    Agniane is an infostealer written in C#.

    stealeragniane

  • Agniane family

    agniane

  • Cinoshi

    Cinoshi stealer is part of Cinoshi project Malware-as-a-Service (MaaS) written in C#.

    botstealercinoshi

  • Cinoshi family

    cinoshi

  • Detect Cinoshi payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3behavioral4
• • Target
    f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5.exe
  • Size 244KB
  • SHA256 f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5
  • MD5 6001560e7fcf13eb1f1f4eeaaf7799cf
  • SHA1 569f6b1e40d83946db3594d604155bbc9240852d
  • SHA512 4b9fa3d8e3db988c9e96dad0b61e0b354cb98d3d381fe61dbf67de9e3e8fb7b7bb0052fb97c846803b74bffab9107963691bdc6b4e5030b711a17e2c31d37be9
  • SSDEEP 3072:HwtrEMpgVttttfDKbQygut+qzTx8hmmFanM4UOYpExCO/Qzz8EZ:H+PKNDpG+qhaaM4yExCO/Qf8EZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  discovery

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral5behavioral6
• • Target
    fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21.exe
  • Size 142KB
  • SHA256 fc1b0f044807d4f0f7d3c68c1adb2f38da0f8a577e11322102559b6467c1fd21
  • MD5 6c209163f8881e51e553f6c1b306d645
  • SHA1 9e6692f04c6ce18c4b95e9614b26dcbd47099de7
  • SHA512 d70905196a6c3d3ef3ac8d6a234c94733ce513d127a3b9edf141fa8267d90d811dbadc4a6aca5f135a3e71f21881007e422c8616a577327c00aa6b8d30064fa0
  • SSDEEP 3072:oGlXG5eobrf35GO002X9CHWAhCr6m/bYQu5UwOl3xd:IxbrfcO002X9CHWAhCr6m/bYQu5UwOl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discoveryspywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral7behavioral8