4c9658c80422824f71e5ccf8792a98525c85abb5cf88411c5f4b8939e958368b

General

Target
Boostrapper_v3.5.7.zip
Size 3.2MB
Sample260621-2seq9sgx3v
SHA256 4c9658c80422824f71e5ccf8792a98525c85abb5cf88411c5f4b8939e958368b
MD5 45d7ec23ca94c3d45129537ec8cfa28e
SHA1 f96d0afc10f20a2724717f9120e0769d1bc338fa
SHA512 ce441b689341807f57fd4eb7c9a28d7439ee88e7e557e63a25d3e35833cb363f1e116bbb11e2d9793d507b039142be6db1b0c458c46059bac4a7b1615756d578
SSDEEP 98304:ESksT0iezPzGrT2vhYXDsXhYwjyxxed63fKYKmONQ:lksT0B726puYhYwjyzL3SYKmOm
TLSH
T125E533FA6AC0F439E47274B797A37F29447ECFFD54F209548126A13A8D408E66A73C84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Bootstrapper_v1.4.5/mpclient.dll
- Size 3.8MB
- SHA256 2a194bf50e616dc3fe74c791273edaa5deab687a73a6c9b7feb33a6f40554c72
- MD5 4b5e5e3559bcf4791b27b3f22581d144
- SHA1 506c76f6ee6a75194f1956bd9b44b3377548f284
- SHA512 51b5d671ff1daf72d5d352643f3973d8bee4d939beac608a7a80974953e06ded11a5f609f1ec6d0c6521eaf4d7d6b64fbdec18a9c8235d1b31ca699ebaa7e03e
- SSDEEP 49152:FWlUHA3xsfsoEQtIxti+grMNCagTfvYT26NoVID7qqsTVci:FRtCEWJYh6PQBci
- TLSH
  T108068D06EE914879C09A633288B39681773CBC491B3637EB2E9462793F777D05937B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Bootstrapper_v1.4.5/Вооstrарреr.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4