906d822ab1f014f7b3cfa7a35564a524fb02149a1f692b245cf9c7f1b7882a2b

General

Target
Cheat (Russian Fishing 4).exe
Size 4.7MB
Sample260511-nxeeeabz8k
SHA256 906d822ab1f014f7b3cfa7a35564a524fb02149a1f692b245cf9c7f1b7882a2b
MD5 1ecfc85fcbe4f9be994bbe06abb5e849
SHA1 deeb495831210cb06e499eca3ad28d65b1295eb7
SHA512 4227ab3a26f9855cba4f9d312e67c366c8017dfd016ec996e1f82c67531a441db6d608bf4ed3acf5e932008a9849799b80b66df1a6528d92216e3d83017fa586
SSDEEP 98304:JEonzOQY8CilFNmum8vO8jTy+ejkVEUBmz6c/aboiHYAQMib:igJYaLxm8J2+ejkVEWSco7AQr
TLSH
T1B2362391CEC6C16BEB29473E1639DD0E926FDD28223650E9DEBFF0B17B755AA0420413
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cheat (Russian Fishing 4).exe
- Size 4.7MB
- SHA256 906d822ab1f014f7b3cfa7a35564a524fb02149a1f692b245cf9c7f1b7882a2b
- MD5 1ecfc85fcbe4f9be994bbe06abb5e849
- SHA1 deeb495831210cb06e499eca3ad28d65b1295eb7
- SHA512 4227ab3a26f9855cba4f9d312e67c366c8017dfd016ec996e1f82c67531a441db6d608bf4ed3acf5e932008a9849799b80b66df1a6528d92216e3d83017fa586
- SSDEEP 98304:JEonzOQY8CilFNmum8vO8jTy+ejkVEUBmz6c/aboiHYAQMib:igJYaLxm8J2+ejkVEWSco7AQr
- TLSH
  T1B2362391CEC6C16BEB29473E1639DD0E926FDD28223650E9DEBFF0B17B755AA0420413
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection defense_evasion discovery persistence privilege_escalation ransomware spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2