5d2991a85516c16d2453c18eaf00258c975a420daf646d9b4926f5ea539312f6

General

Target
file.exe
Size 2.1MB
Sample260623-skd1bsdz2w
SHA256 5d2991a85516c16d2453c18eaf00258c975a420daf646d9b4926f5ea539312f6
MD5 f0fa4d3ebb6a88632fc6431772c999e1
SHA1 f258aedfeb5f8db725277e01160b14b788d609f3
SHA512 73a9ce797dd9a5e3ad3f0549bcb82877d87fdcf3b549437a5241fda770e034f850fb7b85e3e28d04368bbf7f1250ab59683fb267f4443402960f6e537957fcee
SSDEEP 24576:9PrKpDs5Z2R71Szb+fRGgiYmnQnSFYzV/txJBele5r92mCNWLcH:9PrKhyZaSH+J96nESFcvV
TLSH
T1E7A56B077CD149E9C4AD677189B661927B34BC080F3627D32E90BB782E72BD19C76B84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  file.exe
- Size 2.1MB
- SHA256 5d2991a85516c16d2453c18eaf00258c975a420daf646d9b4926f5ea539312f6
- MD5 f0fa4d3ebb6a88632fc6431772c999e1
- SHA1 f258aedfeb5f8db725277e01160b14b788d609f3
- SHA512 73a9ce797dd9a5e3ad3f0549bcb82877d87fdcf3b549437a5241fda770e034f850fb7b85e3e28d04368bbf7f1250ab59683fb267f4443402960f6e537957fcee
- SSDEEP 24576:9PrKpDs5Z2R71Szb+fRGgiYmnQnSFYzV/txJBele5r92mCNWLcH:9PrKhyZaSH+J96nESFcvV
- TLSH
  T1E7A56B077CD149E9C4AD677189B661927B34BC080F3627D32E90BB782E72BD19C76B84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer themida trojan adware ransomware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2