fb4b8a8a08eb8b4fce191c04434f1fe37845565b84d45a6cb134036dd9324028

General

Target
Webfisher Setup 1.2.5.exe
Size 86.5MB
Sample260706-ae26vsct2r
SHA256 fb4b8a8a08eb8b4fce191c04434f1fe37845565b84d45a6cb134036dd9324028
MD5 8ba632d9ddf72a4fa54fe746600008eb
SHA1 2df73de96eed998260d290d0c0fb0d132a575ce9
SHA512 22f5b3e839284f53916a1aebcb8fe7229c3ee4107a1aaaee8d0e1a51576870ca055407eadce09da9caac152981e93396d45347600bba5944987f967d9b13622a
SSDEEP 1572864:ul+BWMFDe45kdiUW4Z6hDRVO2rJa1SWMDX6lrPsrFVHqusrGTl9a9L73:usBFle45B4shDRVlxTD2srwrGzaJj
TLSH
T1BC18332D2EB89E57C58D353F05F13A6F198B99970F2D562F13BF8D2C24C8522A936780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Webfisher.exe
- Size 164.6MB
- SHA256 b61a3143391f076a68bc8eafc03e30124e232f8fe4501e79ba52342a5da969b6
- MD5 e046397be2c106c5a7427e88ba1652e9
- SHA1 364ca256d7353a20628e0270d431e82c0e62bf02
- SHA512 ccd4736d22481a841f34fb6c7f1e8c27a1ae2e0381581e16e86c60424b7117fdb24c263bc086bf665a468305ad2bfc969162fa5d2d8f4d2c4e4fec7afee3ac14
- SSDEEP 1572864:ES8FIVRV+pz0o4AbRqkaGadu15dyLgOR+39jK8DKOdCisaIZtaAbJsScW8fe07ra:Bt1azadiF2E3ra
- TLSH
  T12D888C03F29650E9F05DD1B19B578236EA72B8864738A6DF175407292F77FE02B39B20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer adware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2