26742d87cc980cc139521094d045f2f732a495431cf6d83757c3e29f34d6fa23

General

Target
boykisser.exe
Size 1.5MB
Sample260701-b7n1dab19p
SHA256 26742d87cc980cc139521094d045f2f732a495431cf6d83757c3e29f34d6fa23
MD5 19e63312d05b300aca57f65d0c133ac2
SHA1 2a8970a6660eaa3d1d230e351fa9f25b28cbe471
SHA512 20e9f383ee49896dc45a0d8db55be8df3b43822057a1c29740cd89d5cf5a01ebf1de04b27714f777a5a7c4d0d273306ec1e3acd3656f9136d1e8f6282a9f3c2c
SSDEEP 24576:Ral5uHnESGtWAvp+loWgbY/v76cHpqkwD4VAJQW4NC75Rvl53Z813SWI:uoHnESaEW3M/v76cHpq5XP/lR63SW
TLSH
T18D7533C6C40C2AA7D1FCE7F3CABB65CADAD40C2721EA858451DBE9917C209C85867E74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  boykisser.exe
- Size 1.5MB
- SHA256 26742d87cc980cc139521094d045f2f732a495431cf6d83757c3e29f34d6fa23
- MD5 19e63312d05b300aca57f65d0c133ac2
- SHA1 2a8970a6660eaa3d1d230e351fa9f25b28cbe471
- SHA512 20e9f383ee49896dc45a0d8db55be8df3b43822057a1c29740cd89d5cf5a01ebf1de04b27714f777a5a7c4d0d273306ec1e3acd3656f9136d1e8f6282a9f3c2c
- SSDEEP 24576:Ral5uHnESGtWAvp+loWgbY/v76cHpqkwD4VAJQW4NC75Rvl53Z813SWI:uoHnESaEW3M/v76cHpq5XP/lR63SW
- TLSH
  T18D7533C6C40C2AA7D1FCE7F3CABB65CADAD40C2721EA858451DBE9917C209C85867E74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion persistence ransomware upx credential_access discovery evasion execution impact spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2