761f2ec0861696fee80b207adc20bcb34bf23b19370c93fe47fcfca1b0b6813d

General

Target
fantasysouls-Installer-Wizard-1.4.2.exe
Size 73.4MB
Sample260623-pddjfacw91
SHA256 761f2ec0861696fee80b207adc20bcb34bf23b19370c93fe47fcfca1b0b6813d
MD5 da8fcf64103f4ad26be5cbfe0468b1b3
SHA1 e31232786aa96d6ab71c5ad68c78bfa533855b67
SHA512 3e4c0462a48fff2cd2a8863338546d30307f608be08f081b366b31e7d6a352eca5157105878db9255c8c5c6b34d4520c6363d0f0f2c3dc9e3451a48843f36272
SSDEEP 1572864:hfejOYfEp0wj63PD5e7PlXvwMptXkXUbI4R10SMexuCKcBb6bkPs2:hf4824wgVLR1iTCKUbokP1
TLSH
T16FF733619ADF9AC8CB75E13B75A25F18080C1D131B0C52AFCA7D9DFAD3A6930661CF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  fantasysouls-Installer-Wizard-1.4.2.exe
- Size 73.4MB
- SHA256 761f2ec0861696fee80b207adc20bcb34bf23b19370c93fe47fcfca1b0b6813d
- MD5 da8fcf64103f4ad26be5cbfe0468b1b3
- SHA1 e31232786aa96d6ab71c5ad68c78bfa533855b67
- SHA512 3e4c0462a48fff2cd2a8863338546d30307f608be08f081b366b31e7d6a352eca5157105878db9255c8c5c6b34d4520c6363d0f0f2c3dc9e3451a48843f36272
- SSDEEP 1572864:hfejOYfEp0wj63PD5e7PlXvwMptXkXUbI4R10SMexuCKcBb6bkPs2:hf4824wgVLR1iTCKUbokP1
- TLSH
  T16FF733619ADF9AC8CB75E13B75A25F18080C1D131B0C52AFCA7D9DFAD3A6930661CF60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1
- Target
  fantasysouls.exe
- Size 168.6MB
- SHA256 389db5c9cc19575e1c8e21201d2cd847adacaf95d49033f6dfa3c4e11a9adab1
- MD5 37dd435acad8b1ea8725f709f8079faf
- SHA1 c14008a43223ae0dee3940e0121618e89fa41209
- SHA512 111d9620d4894dd2ec2ef18de49fe5b890f8a4f25a6eca4e9144ebbf795a1dc02906bc74756c654af7f9f719dd125fd25d07daad40c2927f03c2d73bbe60c86d
- SSDEEP 1572864:jOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:ngmeNxNNZxqV
- TLSH
  T1E1887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral2