a91024f0861ea309563113f897e4dce32616ee4b5fd5c4c910d7ef47bcf3e0e1

General

Target
_a91024f0861ea309563113f897e4dce32616ee4b5fd5c4c910d7ef47bcf3e0e1.exe
Size 464KB
Sample260707-qv7dhsgs2j
SHA256 a91024f0861ea309563113f897e4dce32616ee4b5fd5c4c910d7ef47bcf3e0e1
MD5 f448fb1c252984abfa34a6edb142ab5f
SHA1 6af3a5703945015b999997a3e1f05bdf37cf2257
SHA512 0944d3cf428d658e4740204f21280c0ea1b57366546998f82e9643861042c9b55a7180dedce642c09a17fe2d6062d5e897ec6601347ee93a81f47afb12504821
SSDEEP 3072:FhAZlsCVAcw1GbQ6Vaz8OTARkZ5q96lXpKvwruSfNBuqdz0q1NVJXyq6KVg:FCeC41GbDahzXpIw8qFpyqbVg
TLSH
T18FA4714EEB4721FAE7EC9878810041BFE36672555F209ED77120BA43E613A9F8C7D681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _a91024f0861ea309563113f897e4dce32616ee4b5fd5c4c910d7ef47bcf3e0e1.exe
- Size 464KB
- SHA256 a91024f0861ea309563113f897e4dce32616ee4b5fd5c4c910d7ef47bcf3e0e1
- MD5 f448fb1c252984abfa34a6edb142ab5f
- SHA1 6af3a5703945015b999997a3e1f05bdf37cf2257
- SHA512 0944d3cf428d658e4740204f21280c0ea1b57366546998f82e9643861042c9b55a7180dedce642c09a17fe2d6062d5e897ec6601347ee93a81f47afb12504821
- SSDEEP 3072:FhAZlsCVAcw1GbQ6Vaz8OTARkZ5q96lXpKvwruSfNBuqdz0q1NVJXyq6KVg:FCeC41GbDahzXpIw8qFpyqbVg
- TLSH
  T18FA4714EEB4721FAE7EC9878810041BFE36672555F209ED77120BA43E613A9F8C7D681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution installer persistence spyware stealer upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2