9b61ad0272eed7c9deb9500ed71d0e0437b8c467a015d5452d06429ef47a8bf6

General

Target
audio [music].mp3
Size 1.7MB
Sample260706-nrpyysat8r
SHA256 9b61ad0272eed7c9deb9500ed71d0e0437b8c467a015d5452d06429ef47a8bf6
MD5 d6c57db7294739e15e195d8dd12d1062
SHA1 b7cd8f5f99c7a9f7ab9e82f741ff1d0927417d45
SHA512 2334bcac4adbec45260b265129f2779416b5bde59bf2a4d2813027e1cb04410b7575b3283a428ca9f1c050abd4c6798526a1e2bb8fe48481f4207e6687d9e0b5
SSDEEP 49152:Zg6bxZdzdQZAl8uG7HRkiwcij8wHSTMPsnjmT5:zbxvd+O8bHNo0k
TLSH
T1EA8533BF8C66B926A52415321FD1DE2502B15C9A1C4AF327B28433D51CF2A67BE7233D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  audio [music].mp3
- Size 1.7MB
- SHA256 9b61ad0272eed7c9deb9500ed71d0e0437b8c467a015d5452d06429ef47a8bf6
- MD5 d6c57db7294739e15e195d8dd12d1062
- SHA1 b7cd8f5f99c7a9f7ab9e82f741ff1d0927417d45
- SHA512 2334bcac4adbec45260b265129f2779416b5bde59bf2a4d2813027e1cb04410b7575b3283a428ca9f1c050abd4c6798526a1e2bb8fe48481f4207e6687d9e0b5
- SSDEEP 49152:Zg6bxZdzdQZAl8uG7HRkiwcij8wHSTMPsnjmT5:zbxvd+O8bHNo0k
- TLSH
  T1EA8533BF8C66B926A52415321FD1DE2502B15C9A1C4AF327B28433D51CF2A67BE7233D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1