cad78bebe3ab5de69962e476bb0b147b6b75f0126f59b4926cbee8e02a249874

General

Target
file
Size 325KB
Sample260531-l5ph8set6x
SHA256 cad78bebe3ab5de69962e476bb0b147b6b75f0126f59b4926cbee8e02a249874
MD5 98ddb40f1be6d2622f939217f580600c
SHA1 67ea0c7c65973dbd55346ec0cd73d3be6172b0ba
SHA512 d920021a440532dff5c56d9d56d4ee1d8735385d29ae4391faade360ba8cd777bbf62b2a3bc7bbce2a19a37fb48619d9332832bf8934811de92c26f1c39cfe02
SSDEEP 3072:tY8gAkHnjzxQ6KSAiT8H+88aW+LN7jxRLlzglK3f2V17:vgAkHnjzxQBSA9e88CN7DB3f2V17
TLSH
T17E643C25E5D2607F682B8033F27F3318B77FA483A101C965BA1CC1E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  file
- Size 325KB
- SHA256 cad78bebe3ab5de69962e476bb0b147b6b75f0126f59b4926cbee8e02a249874
- MD5 98ddb40f1be6d2622f939217f580600c
- SHA1 67ea0c7c65973dbd55346ec0cd73d3be6172b0ba
- SHA512 d920021a440532dff5c56d9d56d4ee1d8735385d29ae4391faade360ba8cd777bbf62b2a3bc7bbce2a19a37fb48619d9332832bf8934811de92c26f1c39cfe02
- SSDEEP 3072:tY8gAkHnjzxQ6KSAiT8H+88aW+LN7jxRLlzglK3f2V17:vgAkHnjzxQBSA9e88CN7DB3f2V17
- TLSH
  T17E643C25E5D2607F682B8033F27F3318B77FA483A101C965BA1CC1E5AFD19862177B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware collection defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Modifies boot configuration data using bcdedit
behavioral1