c329cf9d0d6979c29ed5e9b0e1f0af3c988d314c61e4d06af9c00eb1d5445c8c

General

Target
c329cf9d0d6979c29ed5e9b0e1f0af3c988d314c61e4d06af9c00eb1d5445c8c
Size 21.1MB
Sample260706-kbeaqsgv2m
SHA256 c329cf9d0d6979c29ed5e9b0e1f0af3c988d314c61e4d06af9c00eb1d5445c8c
MD5 ce61873aa1a86237e5c20ef638eaa161
SHA1 dce270d35da11db8b8237c008ad272163b26869a
SHA512 25af8853684e4b799cefd2eb405b9b1aad039ee1fe06ebb754ca06c987dc68f4ca28bac3fbf3980fb69dc7e480f8b6219c37f2b6c35a74c56de9091ffe5e626c
SSDEEP 393216:ejp0zBg8lLHycFjV8E0Uq7jLJjJuJiPTNH166cCnOeg6s1L5:zlVxHyc1SE0U2nTuJiZHs6Lts
TLSH
T1CF273358E2574BDCC5A9BB38BA6893C4E3A6EC1257119BCB91F0317A6D33DD18E34234
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  c329cf9d0d6979c29ed5e9b0e1f0af3c988d314c61e4d06af9c00eb1d5445c8c
- Size 21.1MB
- SHA256 c329cf9d0d6979c29ed5e9b0e1f0af3c988d314c61e4d06af9c00eb1d5445c8c
- MD5 ce61873aa1a86237e5c20ef638eaa161
- SHA1 dce270d35da11db8b8237c008ad272163b26869a
- SHA512 25af8853684e4b799cefd2eb405b9b1aad039ee1fe06ebb754ca06c987dc68f4ca28bac3fbf3980fb69dc7e480f8b6219c37f2b6c35a74c56de9091ffe5e626c
- SSDEEP 393216:ejp0zBg8lLHycFjV8E0Uq7jLJjJuJiPTNH166cCnOeg6s1L5:zlVxHyc1SE0U2nTuJiZHs6Lts
- TLSH
  T1CF273358E2574BDCC5A9BB38BA6893C4E3A6EC1257119BCB91F0317A6D33DD18E34234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan exploit
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VirtualBox executables on disk
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Modifies RDP port number used by Windows
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2