860a5f27a1c568b4a89723ba44940a583941a85d475611d4f20faaf0058145b3

Sharing

Copy URL Twitter E-mail

General

Target
860a5f27a1c568b4a89723ba44940a583941a85d475611d4f20faaf0058145b3
Size 9.3MB
Sample260706-j6pjhsf16n
SHA256 860a5f27a1c568b4a89723ba44940a583941a85d475611d4f20faaf0058145b3
MD5 e184075fcba4d03d5582d6fe082bc366
SHA1 2950701c378e23cd145b5dfa70802f616ad47df9
SHA512 e758574ad425e11f5998e51d89b4deb198e563e68fb521245d27148387cc9b75a396b6240e0ad22c465f834c67dcb1f19c51b86b075379908f52002b1ec02034
SSDEEP 196608:nSm9A4v/23whU4f+MExS6hwB9IS6ejMRo7nsgszDNEgYvAhPQZ/d/QSM2eoX:nSIA4vOgzGM02ITeQRoNsagYIhP0KFoX
TLSH
T1FEA633745AA806A9F1C59831BDF6213FD5398CC57B573FBAC189133BAB068E4034A1DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  860a5f27a1c568b4a89723ba44940a583941a85d475611d4f20faaf0058145b3
- Size 9.3MB
- SHA256 860a5f27a1c568b4a89723ba44940a583941a85d475611d4f20faaf0058145b3
- MD5 e184075fcba4d03d5582d6fe082bc366
- SHA1 2950701c378e23cd145b5dfa70802f616ad47df9
- SHA512 e758574ad425e11f5998e51d89b4deb198e563e68fb521245d27148387cc9b75a396b6240e0ad22c465f834c67dcb1f19c51b86b075379908f52002b1ec02034
- SSDEEP 196608:nSm9A4v/23whU4f+MExS6hwB9IS6ejMRo7nsgszDNEgYvAhPQZ/d/QSM2eoX:nSIA4vOgzGM02ITeQRoNsagYIhP0KFoX
- TLSH
  T1FEA633745AA806A9F1C59831BDF6213FD5398CC57B573FBAC189133BAB068E4034A1DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware stealer ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $TEMP/MyApp/firefox.exe
- Size 594KB
- SHA256 4c57f9b240b77553711383c7879bdabd080a25c9bac51a67c1b18cfdf145d10e
- MD5 b73a0af34d68b921975fe94a052281ec
- SHA1 4ea0e853e3af41061eb85d1eccdaef662caec118
- SHA512 0af7c45dc4189c52a2df5b38c9b85291ddd4ca872660a4da18dc206a1b5b1458b48643a8d643616848aa5cb7b600d5631e0a4d1f4816e9d269bc685b034e4642
- SSDEEP 12288:EcNKPccaYmPrhNJJNWm4W7ISzwHJem7OzwHJe0IhfLeku:ELTOrbJJsg7IYwpemIwpelDeku
- TLSH
  T199D49D00770026B4E49734B1750AF73BA9755D212F1246C39BE97EAE7E706C21BB622F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence spyware stealer
- Adds Run key to start application
  persistence
behavioral3
- Target
  $TEMP/MyApp/gkcodecs.dll
- Size 10.2MB
- SHA256 84e3af543008d0574593d11b889a8a6a7915145c4354f957fe1b84e5ac5524d3
- MD5 d34ea6f07715a8ed2ef2000d7e9b1700
- SHA1 9c609cc940da6b6029c4f86a9a46cfa1a151b4cd
- SHA512 f0e876e9bb5b87829262b44a2df3052ff05b870f977953afa32377c83cbab8c29366e81039613bfb5e73b15968b10e1497511e29ee33ac1af054365985a4b6e0
- SSDEEP 196608:TGd01PwUCxFut5XvWPRsg7b9d5m9T50tJcC/JKVW6t/GaBf/Qbw2CVq:6d01PwUCxSXvWPRsg7b9d5m9TetJjIWZ
- TLSH
  T1A4B68CC0E2A36164CE078CF4667DB8A7BD1C146EC7614AF7B2C84A7476E3BC05B69B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $TEMP/MyApp/lgpllibs.dll
- Size 218KB
- SHA256 2db63294864c4c6bddae7cee66cf729dd03acb25d4e7702b2e7c7a274a70ab16
- MD5 5d35ef56c6be34e700164d3609e5f092
- SHA1 4df64f11a46c627d54c3aa132ce0abccee9c5bce
- SHA512 c37cd61223cac5773668adf03d6d6ba435d2b9f893e1bfe50bee4a66a04d0d6a01850222f2be624dcbd3fcbdd626f14cb1727e4c76410bf7504729571e375165
- SSDEEP 6144:65QXNV76c10eoB/Wgv9Q/upLPB1MYd8rQoTXk1ft7FOdE9boS:OQXrGc1zmj9Q/upLPB1MYO0R
- TLSH
  T1FC247D82DDD48B75CA9BB871341EF12756350388033387C76A64CCB56B4D7EA8A7B14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $TEMP/MyApp/mozglue.dll
- Size 711KB
- SHA256 c6a9d8522de439949961e9eb60e47dad5cd0af53b8e447b7c42b792983ba820d
- MD5 12092df510ac145787cdb5bf8d2fdf48
- SHA1 2c4c87710456e873dc79252bce1a7080b86ee6e6
- SHA512 e0b805d593c4ee1336745f6034be22f5e80be17871d883d27c2d602af72fa309062a304b780ccb8916e0bec2eddfc9ca63ae007ded911c32c4054cc4054f8722
- SSDEEP 12288:wmWdj5RA0mvFnyQhfGBZ+fgeRCkqGQOZUheqTntb0JH1RaOuTujHw:wanIgCktQOOeqp0JH1RGTujHw
- TLSH
  T135F47D03E98941EDE5D93572313EA73E5F3522618730A8C7A7F2AEA11EE12D151BF702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $TEMP/MyApp/msvcp140.dll
- Size 436KB
- SHA256 85aa8c8ab4cbf1ff9ae5c7bde1bf6da2e18a570e36e2d870b88536b8658c5ba8
- MD5 c766ca0482dfe588576074b9ed467e38
- SHA1 5ac975ccce81399218ab0dd27a3effc5b702005e
- SHA512 ee36bc949d627b06f11725117d568f9cf1a4d345a939d9b4c46040e96c84159fa741637ef3d73ed2d01df988de59a573c3574308731402eb52bae2329d7bddac
- SSDEEP 12288:5mtyWf0sTWRzbpT/tD5YpsGx30h7whUgiW6QR7t5s03Ooc8dHkC2es98R:A0HsTWRzbp5D5YpsM3A7v03Ooc8dHkCh
- TLSH
  T1469429327B464DF1E48A13B971C6472293F9FC650361E3C3A3EEE0152F666C5A673A81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  $TEMP/MyApp/nspr4.dll
- Size 310KB
- SHA256 25047320fbb6e91f8a0bd3227ad751475c1cb0d54902007a019d1bdc7a4d6782
- MD5 7d7cdec5c1646e33956b2b0e995deb60
- SHA1 dbddcb69025506ca3658913b49a5ef6fcb9980fb
- SHA512 b957f9283a3aff822850b67295864f768d7eb727310127ae2f26f09e693af0d2e374103d8dc83b3735138c985018743001d8c8991c57f287c0150593d7005e17
- SSDEEP 6144:NnKVGP0o5sxGmF6K2rzUDeGj/wg7z7uW5ubP3:1KaoGmF64Txtuj
- TLSH
  T1E664C2C241A5C1A2D27A35707822E7535BEB28F13B30C4477F411BC91AECAAC59E5EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
behavioral10 behavioral9
- Target
  $TEMP/MyApp/nss3.dll
- Size 2.2MB
- SHA256 1965a6865792e296994b3bcfa213832989488dad1ca1fe16480e5c72e436f9a5
- MD5 f7b946947658f4a38802275aa6a095e4
- SHA1 5dfe96541425372ba1c55c447706452fcecd62dc
- SHA512 292025417e1928537a5c4311d5b10aef50760440bc35c6b2be0e4afbe3c47050645c5436935a78b59239cd415b4a887dfdb4b0090c6cc1750ba6b91d20d02257
- SSDEEP 49152:rcfMKCH/YH7xrYfPBMXeoIBM5W2MeZJ+h8OSBrxAHlYb6d+eNwno:+sQH9EfPBMXWS5W2MeJFBrxiymd+eP
- TLSH
  T185B59F4258509479D58630B2355EAB3D2D3123221B2ACDCBDBC41DD8ABEDBE1677E30E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $TEMP/MyApp/tor.exe
- Size 8.6MB
- SHA256 c42dc8140495a3093e9d2fee2313113bc6a09440b3b533bab40d7a0218462f4c
- MD5 5b561f534e69437d9d3bd1e4544f084e
- SHA1 6eca47e2ca27d363ab624afe62d992d508341820
- SHA512 554f76e5e2879f3bcaa4aaf7876de5c661e1fc8690eb6836a24955c67297a2ef5b04c979033fca23aab42281a464a39d8c208609177c24d27d0e56af0d45ab51
- SSDEEP 98304:fuxQfDJRmk5kcCzWL88zrqi+1iui0uOttSi+C1b172wZ7lFExXPN/cd7:maDJB5IqL8QloX1b1wxfc
- TLSH
  T12196FB03E63361DEC5FAC139952A7323F8B03CDD8635EB67455092A22B74B64AE3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  $TEMP/MyApp/vcruntime140.dll
- Size 88KB
- SHA256 c7d9dfddbe68cf7c6f0b595690e31a26df4780f465d2b90b5f400f2d8d788512
- MD5 9c133b18fa9ed96e1aeb2da66e4a4f2b
- SHA1 238d34dbd80501b580587e330d4405505d5e80f2
- SHA512 d2d588f9940e7e623022adebebdc5af68421a8c1024177189d11df45481d7bfed16400958e67454c84ba97f0020da559a8dae2ec41950dc07e629b0fd4752e2f
- SSDEEP 1536:wd5wd+ywOpmlhcsrG4ckZEzH3qDLItnTwfVkC2KecbGJ13yd+zTNFZFzK:wdJywOpmlPrHI6D+nTwvlecbG/3y8XG
- TLSH
  T1D1936B43B4D48072D8BE097A47A9E6023B3D77A14BD349EB2FA59D8C9F663C1E731142
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15