pennywise

General

Target
ropper_updated.txt.html
Size 37KB
Sample251203-az9rfadk6t
SHA256 878be88e0a7faa6290f65af5b804935e1c5e88f1120bf8fec1c6b7dd54f79575
MD5 b51f79ce4afb12491be89318d608d547
SHA1 ba28288395016f5442605c4ee5af795b6f2dd880
SHA512 12e97a5e28c7a33eff91cebaaf4fb3cd64438f096750f04f2298ea109debd359aa73e1db0cff1b7d8629275b9e76bc433d5015f66eaf1470794b05f4f02dbfaf
SSDEEP 768:dl9raKISCibZ5xU6W13mXl7uf4PURRLOX:TbxU6W1Fz6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ropper_updated.txt.html
- Size 37KB
- SHA256 878be88e0a7faa6290f65af5b804935e1c5e88f1120bf8fec1c6b7dd54f79575
- MD5 b51f79ce4afb12491be89318d608d547
- SHA1 ba28288395016f5442605c4ee5af795b6f2dd880
- SHA512 12e97a5e28c7a33eff91cebaaf4fb3cd64438f096750f04f2298ea109debd359aa73e1db0cff1b7d8629275b9e76bc433d5015f66eaf1470794b05f4f02dbfaf
- SSDEEP 768:dl9raKISCibZ5xU6W13mXl7uf4PURRLOX:TbxU6W1Fz6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery adware google microsoft pennywise persistence phishing ransomware spyware stealer
- Detected google phishing page
  phishing google
- Detects PennyWise
  stealer
- PennyWise
  PennyWise is a stealer written in C#.
  stealer pennywise
- Pennywise family
  pennywise
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2