2f48b0841f7bbccdaaf20ad05e962fb79a0298b73467b68d1ec37fe0baf07271

General

Target
tpremsetup-x64.6.8.1.zip
Size 1.7MB
Sample260511-mvcmcsa12p
SHA256 2f48b0841f7bbccdaaf20ad05e962fb79a0298b73467b68d1ec37fe0baf07271
MD5 2dd1d511f404ed9d882b29d7a25ef832
SHA1 58c4a94d08e31f5009deb401d0480b2ab6dd0074
SHA512 2f481065963c6aaa5b4cc6966d114e60a5c153ad54554588b381a13f34ec8d1535ff9b41658eff86fc31d600ce5687db56b7e21c42d51ab4c2625bafea515554
SSDEEP 49152:GCTMXEaJI8coGYJ/edIRKsedTSbqLyEAG0:G6ahJI6Fedl1TSu6G0
TLSH
T1A285337291918F6D5272E9C2B090F72C1C9FDFA99CB5A904EA1BF1D4E4B9E06000FD78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  mpclient.dll
- Size 2.7MB
- SHA256 91cdaf150a2602b1db4bd00fcabcb557964cf90feadb75540741ec713f10bcb4
- MD5 b253bea931c5050b59296d824b5f4e73
- SHA1 2b1926bf3a0357f1454346b6828386eeb12b8487
- SHA512 2c0d6493391ae4104eb28ebb524454fba4e20a3b692b45c3d238dacf2bfe1463949d95fae4e6d65aaa53871bf55a36d05ffc92172c778b4471a99147188fba53
- SSDEEP 49152:srTuDkbWAHaluLPJsI3d7MgvbF+vP3Epnsm:snyKmuLPJsk7XF+X2sm
- TLSH
  T1EFD58C47BC9188BED09A733288F222957739B8480B3277D33E6169763E77BD05939718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  tpremsetup-x64.6.8.1.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2