ff72d872cdfc11f19521f1cff1b017c21ed652cd5a24fef2c0c4dcf0468131a1

General

Target
AcidHack.exe
Size 94.2MB
Sample260623-mkswlacs41
SHA256 ff72d872cdfc11f19521f1cff1b017c21ed652cd5a24fef2c0c4dcf0468131a1
MD5 36cc2c36d58f3de89a33607c2a728529
SHA1 8d20b4532d3dd62bdd66499905798f5fa82217de
SHA512 a6e8a22a58f308cf7abd8f5981c652fc416571336f45534c515f9b0dabfea74ae098d18ddf0f17e081261a3f0899791ae47df2d9a4a06e77e93dabfb646c8764
SSDEEP 1572864:N4ZAYe4Kj6/yvd81AmH01lwOA5RBLUc9cvUJh2Zb60aBILL1npEncaSw/v9iRkTu:N4mYqfKB07w55R1UcVJh2ZmBQ6Sw/v90
TLSH
T13B2833470F42C2F17E6A3E9A8DDF881430EE6BC873419AC50B9D98107593DECA2D7676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AcidHack.exe
- Size 94.2MB
- SHA256 ff72d872cdfc11f19521f1cff1b017c21ed652cd5a24fef2c0c4dcf0468131a1
- MD5 36cc2c36d58f3de89a33607c2a728529
- SHA1 8d20b4532d3dd62bdd66499905798f5fa82217de
- SHA512 a6e8a22a58f308cf7abd8f5981c652fc416571336f45534c515f9b0dabfea74ae098d18ddf0f17e081261a3f0899791ae47df2d9a4a06e77e93dabfb646c8764
- SSDEEP 1572864:N4ZAYe4Kj6/yvd81AmH01lwOA5RBLUc9cvUJh2Zb60aBILL1npEncaSw/v9iRkTu:N4mYqfKB07w55R1UcVJh2ZmBQ6Sw/v90
- TLSH
  T13B2833470F42C2F17E6A3E9A8DDF881430EE6BC873419AC50B9D98107593DECA2D7676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence pyinstaller ransomware spyware stealer
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1