eb6cbfcb5400a723e67ef3bff45e2b29ab102ff71070e5ba4d3e0e820f4a1d75

General

Target
RealSetup_b9704284e2771f6a1cdd7fc02aa0e470768fbae3054ea2f248b579308d8d2e56.exe
Size 17.0MB
Sample260705-lndemsbv3z
SHA256 eb6cbfcb5400a723e67ef3bff45e2b29ab102ff71070e5ba4d3e0e820f4a1d75
MD5 a14f63f2a3b5c7effbe30c8ead73d1e7
SHA1 d459076f0bf33a37225c0f75fd89dd56b71259c1
SHA512 2b4e0514162f227adfd0db3c7d23bc2ddcfd78b5ec43a245437bf8b7840388757e689777952846ec178847c22b42378a7c338d817d5ec7375edb80f9233596c4
SSDEEP 3072:MRYyGJwDsUAoyV0CdWvHDYdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDyI:MRYfaDsh7WbYq2n9AoxgrKDw/XOv
TLSH
T13C0719443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RealSetup_b9704284e2771f6a1cdd7fc02aa0e470768fbae3054ea2f248b579308d8d2e56.exe
- Size 17.0MB
- SHA256 eb6cbfcb5400a723e67ef3bff45e2b29ab102ff71070e5ba4d3e0e820f4a1d75
- MD5 a14f63f2a3b5c7effbe30c8ead73d1e7
- SHA1 d459076f0bf33a37225c0f75fd89dd56b71259c1
- SHA512 2b4e0514162f227adfd0db3c7d23bc2ddcfd78b5ec43a245437bf8b7840388757e689777952846ec178847c22b42378a7c338d817d5ec7375edb80f9233596c4
- SSDEEP 3072:MRYyGJwDsUAoyV0CdWvHDYdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDyI:MRYfaDsh7WbYq2n9AoxgrKDw/XOv
- TLSH
  T13C0719443BF95619F3BF5F79A8B050504AB6F92BAD1AD30D1C8620EC2E31B51EE50B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection discovery persistence privilege_escalation spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2