8d4ff510c139021526597b4ef9343e243943a8b60d377e5f5990d1d773fc190b

General

Target
KawaiiLauncher Setup 1.0.0.zip
Size 191.0MB
Sample260425-txd2jadx3t
SHA256 8d4ff510c139021526597b4ef9343e243943a8b60d377e5f5990d1d773fc190b
MD5 1179714b57f47def1bde64c47fe1e90a
SHA1 0e952213e1f8fe6d2331ac8a3ad25e4f8c9a681b
SHA512 65f71814a65f250b7ddc73d9328df2984bd8e93dfcd7f083c58c200b7ab957c522c24491e3581fbad18a2fbd41faf617339ab91da3a82afe1a656a945cbf6f22
SSDEEP 3145728:n+QaBuH/zEG2igQ1nom4f4xjs7oq8+JTC4OAEabf8uJGMOMHZI4HZ3GNzno8Wp9p:+Q5LEbGsB84TNZgUHZ7Z2Nch9ikzR
TLSH
T114A833FE41F735A340F8F3AA1AAA4F4964628A110F71E8589FA2353C15ECC95583F17B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  KawaiiLauncher Setup 1.0.0.exe
- Size 191.3MB
- SHA256 3c2773b7f69e1b98700c1381aa769a0ae02c7da01004cf64c736d8dc7fd1c12c
- MD5 5a9dca4d8aa9926e808aa6850920237a
- SHA1 11987f213676d57b3c506d41fcc049839eb4b6a2
- SHA512 ec8e86a509f3d79df89be3f2b78728e32b3812d2e546476751064d4c2b2163b8deb05c53166f4827e0e9beaf2b37eb07c50c4dc376b7a69ac54c77ab3b1a5e58
- SSDEEP 3145728:pr2YaHElxJL6FkedtI66pm0tkBE08UXNYIk0k2XJqiFYM0rDtV0N1E7YZdkG86Ps:UYRfLJbkD8ONrXO/LDYZaG8SKTWqd
- TLSH
  T136A833FE11E279A3C0F5D7B55AAB0F0D61A28F122B6298591FA2343C55FC864583F13B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  KawaiiLauncher.exe
- Size 204.3MB
- SHA256 f21c2d19f52c1148c35417dc3cebe937b0e6c7d4ffb92614c447169739d519a0
- MD5 68b43d0b1a74e955afdd80a6aec2b5f0
- SHA1 b3e907baaad2580cf405c0f922316894afa8808a
- SHA512 3a81254d6ab3fdbe048ed8ff9c115732ea390b5c8b22136ad4f351d56a3001d438af9f331eef28276e2e859e2e01f87be4e1d59c88ddbfe7a347cdc872e15fb1
- SSDEEP 1572864:WKJebtd8k43qrSB3JAkcEAarI353fqrV2Ntrd0DMTlQAGrR/v9dCo0r3XXJqWuDY:kxk3JZIXlovhG9
- TLSH
  T146A87C03E2DA01D9C05DD175575A9633FEB1B8094724B6DF2B940B922F76EE82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery persistence spyware stealer
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral2