248556f6d6b0e6979972833957caec666d31af74985cbb14877fc6e7d1b74f87

General

Target
oioi.exe
Size 15.9MB
Sample260705-wkpcvaat8p
SHA256 248556f6d6b0e6979972833957caec666d31af74985cbb14877fc6e7d1b74f87
MD5 8850fd323c611252b5216fae64204176
SHA1 7d3f64291487ceb3dc2be5a5cd2f00d3e5436b92
SHA512 f2a5ad5df144b3e92a4cf43d8b7f0814a66e709bc2db3f8b0bd2106ce43944839fbf97f26164a1de260284c859371afbb8246e888793a257bce3f1a6c8f03d51
SSDEEP 393216:cBehLDu12pXEAphVtlIwQSg+1/iZB37Xh5ogodjPRvk7do3plk:3fLpRphxBo+RiZBrxygod5vk7l
TLSH
T144F633A9B18155FAF8E6503D5A61C560E3B0B5402F05C2FF1BF44A113E3BAA64F3C6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  oioi.exe
- Size 15.9MB
- SHA256 248556f6d6b0e6979972833957caec666d31af74985cbb14877fc6e7d1b74f87
- MD5 8850fd323c611252b5216fae64204176
- SHA1 7d3f64291487ceb3dc2be5a5cd2f00d3e5436b92
- SHA512 f2a5ad5df144b3e92a4cf43d8b7f0814a66e709bc2db3f8b0bd2106ce43944839fbf97f26164a1de260284c859371afbb8246e888793a257bce3f1a6c8f03d51
- SSDEEP 393216:cBehLDu12pXEAphVtlIwQSg+1/iZB37Xh5ogodjPRvk7do3plk:3fLpRphxBo+RiZBrxygod5vk7l
- TLSH
  T144F633A9B18155FAF8E6503D5A61C560E3B0B5402F05C2FF1BF44A113E3BAA64F3C6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution persistence spyware stealer trojan adware ransomware
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2