8835274bc1d710401ac4532e82b849863c59247bd67d776976ddeb8c7387916c

General

Target
terminax3.exe
Size 105.5MB
Sample260628-jphdwaf13y
SHA256 8835274bc1d710401ac4532e82b849863c59247bd67d776976ddeb8c7387916c
MD5 a55bf5067f31f320c50c1f593d34d813
SHA1 c5dbd8a05a1a2eb19955a1f4c6f43b26605090aa
SHA512 800358628309d35ffedbb7d6b95641752a2083bc4fd6ac01525332fe6e54e3c6817a12f31db8b0595a7ef1e06ae43c11f394dfd8c13a6b811e62d051d4770759
SSDEEP 1572864:PqrTIAikXJVrvo2pUg9NoX0RpKdw+vWlM9ojCrD4WWJvKSc/JUNnzPhOOThF+r45:apv7ig9NXUBelKbDSc/iFzLF7g
TLSH
T1E83833906F00D5C6E4AD823A96D08E12E8B778BE7AC297DB13F4017A1C9B3C4457DF66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  terminax3.exe
- Size 105.5MB
- SHA256 8835274bc1d710401ac4532e82b849863c59247bd67d776976ddeb8c7387916c
- MD5 a55bf5067f31f320c50c1f593d34d813
- SHA1 c5dbd8a05a1a2eb19955a1f4c6f43b26605090aa
- SHA512 800358628309d35ffedbb7d6b95641752a2083bc4fd6ac01525332fe6e54e3c6817a12f31db8b0595a7ef1e06ae43c11f394dfd8c13a6b811e62d051d4770759
- SSDEEP 1572864:PqrTIAikXJVrvo2pUg9NoX0RpKdw+vWlM9ojCrD4WWJvKSc/JUNnzPhOOThF+r45:apv7ig9NXUBelKbDSc/iFzLF7g
- TLSH
  T1E83833906F00D5C6E4AD823A96D08E12E8B778BE7AC297DB13F4017A1C9B3C4457DF66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection defense_evasion persistence privilege_escalation ransomware spyware stealer
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1