ecb952cdc165655ed63ff4371c6a9b5d1a6d3e75b3e3ba468b5df0192b40144c

General

Target
Cookie_Extractor_Gemini_Business_v3.8.zip
Size 504KB
Sample260622-ryx5pads6w
SHA256 ecb952cdc165655ed63ff4371c6a9b5d1a6d3e75b3e3ba468b5df0192b40144c
MD5 c608d89900cadf5a6093cc43c931ef64
SHA1 99341c868e7a3935930ceddc37113d275acb4bd1
SHA512 bf746cb6a0279ed82bee8e6308e6edbc1130896c8c26396a76b1df262b058634091e02165e065faefbc5f9acbd4321ee0d0a97dd55e8f4795a86b2945ccea03f
SSDEEP 12288:JGRl4nbDDGIabs/7iiEVwYg2l3/2NHBy+wK8r:lTabs/7iiWw0Kkxr
TLSH
T1B3B423CE5A286CAC5BE85E834F6DBFDA2CF8413F862411F3F3581A14D4C956672A810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Launch.bat
- Size 23B
- SHA256 dce5fc61e153377bb42b53b7dfca841399dd5c94d5fdf2631617a6df8c7cded1
- MD5 b9c3f7efd325c8df5530424182106713
- SHA1 9248b0928bc5f821bdc8994b0b4ce244209fd65a
- SHA512 0f1b3c44291dd2bcd7ecc5ef8128f5282143794e539205942124551c2cd04c5e0e7914314963c203a7f905d89e5d52c02b4ee1806e41436efaf0ba593f389e85
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  luad.exe
- Size 636KB
- SHA256 88ec32a311b56441cfe6126b7780f073f36dfb8808de0dab9219d1a0be9c01ac
- MD5 b1535d38c1501d670ee19bfacdf12fd3
- SHA1 4ac9c168cb3942cd0840af555b2fb89543f0ef3a
- SHA512 70fe68bf2100fb0d33165226c265348734546e3ad6bb2555e8a00eb5793bfa77537cd141f2fa1da0a6237c55aa66d6c50535ef43426bfbfd0ec518efe7875dfb
- SSDEEP 12288:LZijeChH0qL/tXDiqPu9cLWO4YCxLSRyBLZN44:LZTiH0qL1Do+kYCxgl
- TLSH
  T1E9D4BF41B5D3C0B6D9B610704439AB7A5F7FAC210924DCAB83D839B68E306819F577BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  rsp.json
- Size 303KB
- SHA256 acdd9ac3d55c4b1e12a239331145665d9eddf84a7a34fccac164f8afd006f875
- MD5 c73ba3c796aa5bbd96674feb2bc030e2
- SHA1 4ac4218f4a27bb1e0eb5e6d15c16d7c936eb7630
- SHA512 31361c2de346265e270984df12994a1952222e43389568eeaad19416d799f142ae75940c550dd92a81e5940650c1a3fc0f49e92d0ce22c62709a538890c469ff
- SSDEEP 3072:uU3p8rCWeonlssZKwGAHOTzcSE6Cakx9YlQB9PZ9SHL514zyGn0NKP2XtRenuRar:HpDmlsk4UODCnki9B9m14z1mvHSp
- TLSH
  T1B86417E0244819D5DAAB9683FCA34DFA29B764FCCA091B8E0F1DF8F53690594E5EDC01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6