6f8075452b80f23418fd92e80429999ae270a6c4b88ce22cfb4223ba9853d6e1

General

Target
core-silent.exe
Size 73.5MB
Sample260704-eja1dsaw9z
SHA256 6f8075452b80f23418fd92e80429999ae270a6c4b88ce22cfb4223ba9853d6e1
MD5 f61219176469a9f98818c223a40ab36e
SHA1 39c94ed1e92f67fe524f62715530b14f27e2bbb5
SHA512 d2d12942f6b13f79f345fd0b171aa087f0c314704b375bf920a619c16125f574576d15d26ec70a7f888ed8fb77ca100b1cac9411125918274b97d5e14fec96e7
SSDEEP 1572864:eLdkKBpS5U6Up2tFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB747:e2r5Uxp4aABZVPArg/bXeB747
TLSH
T1C3F733848355831EC1DFAFFC512F06E7EE275DF0A22AA4BB0656C474F6D8066D68C24B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  core-silent.exe
- Size 73.5MB
- SHA256 6f8075452b80f23418fd92e80429999ae270a6c4b88ce22cfb4223ba9853d6e1
- MD5 f61219176469a9f98818c223a40ab36e
- SHA1 39c94ed1e92f67fe524f62715530b14f27e2bbb5
- SHA512 d2d12942f6b13f79f345fd0b171aa087f0c314704b375bf920a619c16125f574576d15d26ec70a7f888ed8fb77ca100b1cac9411125918274b97d5e14fec96e7
- SSDEEP 1572864:eLdkKBpS5U6Up2tFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB747:e2r5Uxp4aABZVPArg/bXeB747
- TLSH
  T1C3F733848355831EC1DFAFFC512F06E7EE275DF0A22AA4BB0656C474F6D8066D68C24B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan spyware stealer
- Windows security bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- System Binary Proxy Execution: Rundll32
  Abuse Rundll32 to proxy execution of malicious code.
  defense_evasion
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2 behavioral3 behavioral4