Extracted

• • Target
    App_launcher.exe
  • Size 100KB
  • SHA256 1ffb69343b0eb7796665a028c5c91cc3e0285183988abbaa6e07c5fab787648a
  • MD5 63dffbbbfbfb1f344eaa411ee8fa7bec
  • SHA1 e1d0acf14452868691dcca09c210e24333fc89f3
  • SHA512 b2d7837ef8a1945a649a86b4a41f199f9a55ae06374e1d2110146a6cb53549f250d3e682c5fcdde0e4bf52baae61f2ff89531d3688d6e8bbc471b721bc2635d1
  • SSDEEP 1536:4LT11uyRFNsa9N/urOKwjAEHxPNgE71x48suYjsW4dTRR6Q797L:MTzuyRFNN9N/wwjtHxvWuYsTRUQRP
  • TLSH
    T1F2A36C9767E038F9E4638B34ECE14915E772F96606B18B8E1394416A5F233C19E3CB36
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealerupxdefense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2