1d14826d7116464023b0f823aa9c695cb8bc43a2403ed1d9fbb46fd2032d5025

General

Target
1d14826d7116464023b0f823aa9c695cb8bc43a2403ed1d9fbb46fd2032d5025
Size 3.9MB
Sample260702-bvf41aax8y
SHA256 1d14826d7116464023b0f823aa9c695cb8bc43a2403ed1d9fbb46fd2032d5025
MD5 5e650484034a17c33da7f43c624b0b1a
SHA1 b5055d9dc6007f3cc307b062fbf6f8478dd751bc
SHA512 6738b03372e76ddde31fc916a87395ddbe873c8849592e0255e8fc21ce1742ff19f42aef5c77685b25234577a2389ff7237d1144b7af3f95d64d9288e92cde62
SSDEEP 98304:mOsarMJIG9q1NT/rWNdTAtB5JwX+GGpXgmpP3lT3BI2FK:maQJIhTTWNGB5iX+npXV3lTav
TLSH
T1FA1633A0C5B6E1E3C59B4A31010E1FBFCB8269B0B7445C172FBCF6663413FE28699656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  1d14826d7116464023b0f823aa9c695cb8bc43a2403ed1d9fbb46fd2032d5025
- Size 3.9MB
- SHA256 1d14826d7116464023b0f823aa9c695cb8bc43a2403ed1d9fbb46fd2032d5025
- MD5 5e650484034a17c33da7f43c624b0b1a
- SHA1 b5055d9dc6007f3cc307b062fbf6f8478dd751bc
- SHA512 6738b03372e76ddde31fc916a87395ddbe873c8849592e0255e8fc21ce1742ff19f42aef5c77685b25234577a2389ff7237d1144b7af3f95d64d9288e92cde62
- SSDEEP 98304:mOsarMJIG9q1NT/rWNdTAtB5JwX+GGpXgmpP3lT3BI2FK:maQJIhTTWNGB5iX+npXV3lTav
- TLSH
  T1FA1633A0C5B6E1E3C59B4A31010E1FBFCB8269B0B7445C172FBCF6663413FE28699656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  daily-huddle.exe
- Size 7.7MB
- SHA256 be0a661c64096b0695ffbbb13ebfd9d85888786cf56efa62ca317f466987e54a
- MD5 c29f8c74147b2de55f2b40ec8c0bba6f
- SHA1 ecfa93516a9dd3832b69c0674253849abb0b8490
- SHA512 196433fa0d7763c70fa840171a02ce8ff9b124fef7cacdbf1ee5e46a9356ff5384f05c410f2c68548015f67750a5e6b00a680ef0d9ea39d29f769f8688e9278d
- SSDEEP 98304:iR75Y6PIa9webXhvnzXcVUFWUH1qe42TbO95p9F9UDAg37dXogin+:Qdz/nO9TfeAgLdnY
- TLSH
  T11C866C07E29480E9C1AEC0B8C31B9637EF72B8895524B29F5BE44B512F27F506F1D71A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral5 behavioral6