Extracted

• • Target
    SecuriteInfo.com.Trojan.Siggen32.45684.3076.18531.exe
  • Size 2.1MB
  • SHA256 d58de1bcb41688adbb8967b0c5ba83b5c5beae7de4c9fe1b24382db7902c19f1
  • MD5 3703648e5586cbfb3539862dc2251298
  • SHA1 5f6f3e0e474043136774cb29bff0cd522ae2782f
  • SHA512 24a6c0d28ac757c5a2a3d5e27156ee10629e2dcdcf6674b5f33011833260cd7a104b5cad1286d73b174b39eba3e6a120e8e3383b34f665fba4736c6d512c71ec
  • SSDEEP 24576:M34mYI6XF/yQn+RY/hDzDVfgrNehFUdJO12pFvp76cVgV4B3uM7L3Fu7p5fFUGZ/:KBKyQ28zD2rNuMFvV6cqVM3vL3Fujh
  • TLSH
    T1D3A58E4667A901F8D877C178CD462217F672B4081774ABEB45A08DAA2F33FE13A7E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectiondiscoverypersistenceprivilege_escalationspywarestealeradwareransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2