854ee5fee852d9cbf58ab26c7dcf3d1cc9086065c25e18c35b7cae9c2add585b

General

Target
Spirit-Loader.rar
Size 797.4MB
Sample260623-lvqnjsb14s
SHA256 854ee5fee852d9cbf58ab26c7dcf3d1cc9086065c25e18c35b7cae9c2add585b
MD5 d6340b95731de6dc8726c19115e38b54
SHA1 45bcd505f545949a035551ea6d8249abe4dccf4c
SHA512 fbcb5461f71e1272158209b8cf9674bda3fa3a311873a491c1184b29e61857270702dd3f22a3d1c65b9135e916e95fb7f39a2c489e4740bb1ac6c4f5d2f507d9
SSDEEP 25165824:zKMOTnJGKhAbj0zu7SqSx2RJRc3NtUEaLhVLv:xUnJ+v0zu7SNARcDtazT
TLSH
T1DD9933FE1B81F2F4307D50E097F0A0C08D592B59AEE39A76835B651B88FB21ED19167C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Spirit-Loader.rar
- Size 797.4MB
- SHA256 854ee5fee852d9cbf58ab26c7dcf3d1cc9086065c25e18c35b7cae9c2add585b
- MD5 d6340b95731de6dc8726c19115e38b54
- SHA1 45bcd505f545949a035551ea6d8249abe4dccf4c
- SHA512 fbcb5461f71e1272158209b8cf9674bda3fa3a311873a491c1184b29e61857270702dd3f22a3d1c65b9135e916e95fb7f39a2c489e4740bb1ac6c4f5d2f507d9
- SSDEEP 25165824:zKMOTnJGKhAbj0zu7SqSx2RJRc3NtUEaLhVLv:xUnJ+v0zu7SNARcDtazT
- TLSH
  T1DD9933FE1B81F2F4307D50E097F0A0C08D592B59AEE39A76835B651B88FB21ED19167C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Spirit-Loader.exe
- Size 703.2MB
- SHA256 a6b4fa3c912786a651964a7abd6b67543e58061485c27020d9e1cf5237039a8b
- MD5 7eb2633085d7071b4c7f1f749d603804
- SHA1 9008337486187391de5d502ff4061cf0f3e3ef50
- SHA512 79f65f75b2c0788d7ef18a90193ebe552fe3a9d6e5031bcd0dd3271b86da9016ea245a94be530f9d0afa1bce56e3a038bf40fb5ab80daf56ad46194c74676144
- SSDEEP 49152:1Rz/UgFbXDcJs5Zh9MfhI8wIcF/8JPAOYZYyO:1OGm5VwIcFUJIOYjO
- TLSH
  T15D798D07FDD108EEC1AAA33189A3A1927775BC081B3263D72E9067792F767E05D31B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware credential_access discovery persistence ransomware spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4