58aecdc00cecc0a2601fbaab0023a0e125d972769fe9a3e04c24e8333ac55400

General

Target
KeyGeneratorPro.exe
Size 2.8MB
Sample260207-vpylmsfv3c
SHA256 58aecdc00cecc0a2601fbaab0023a0e125d972769fe9a3e04c24e8333ac55400
MD5 204fa4b4ebf3a18e2183462eb0c87da6
SHA1 3f8c0aafeb95c8569c16ed067ebadf420bbb90ce
SHA512 a56adec613e65c1ff0faa41b26637c40d3ab81e7eb39865229e65b6948537d573075b324a99259aa58fed7e2690711674f128f981245e35446f2bd7853e64d52
SSDEEP 49152:YNGZEXurRHg9orH/oKCQOydhYMJucKK6q3MqCc/9kye8:YcauTH/oFQOyrYMkcKzjw9kc
TLSH
T1F9D5AE0AF25349D5CC5BC0BC839B7131EB317D69CB242EDB17918B613E55B806B29F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  KeyGeneratorPro.exe
- Size 2.8MB
- SHA256 58aecdc00cecc0a2601fbaab0023a0e125d972769fe9a3e04c24e8333ac55400
- MD5 204fa4b4ebf3a18e2183462eb0c87da6
- SHA1 3f8c0aafeb95c8569c16ed067ebadf420bbb90ce
- SHA512 a56adec613e65c1ff0faa41b26637c40d3ab81e7eb39865229e65b6948537d573075b324a99259aa58fed7e2690711674f128f981245e35446f2bd7853e64d52
- SSDEEP 49152:YNGZEXurRHg9orH/oKCQOydhYMJucKK6q3MqCc/9kye8:YcauTH/oFQOyrYMkcKzjw9kc
- TLSH
  T1F9D5AE0AF25349D5CC5BC0BC839B7131EB317D69CB242EDB17918B613E55B806B29F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
behavioral1 behavioral2