640007277605240e41f21448e37fb43d70021b20785fc0ba0b0eb96760b153c1

General

Target
640007277605240e41f21448e37fb43d70021b20785fc0ba0b0eb96760b153c1
Size 12.4MB
Sample260708-29be6sbt2v
SHA256 640007277605240e41f21448e37fb43d70021b20785fc0ba0b0eb96760b153c1
MD5 f7691fa433da7e8ac1d224cdf4f51d1e
SHA1 c388142b6a83cacbb0fd77aabfef9a1ba7f69411
SHA512 65cd16a1e60e3a49a94362578a1b764d952ee043b659c5e19b3ba7d3662c9c98dc7ea087c33686fb7d5b2012445828c34b67c66867ccf30ae46497bc29080147
SSDEEP 393216:Hq17j1gSO/siHAg9oI4YNvlO0Pxzd5B0p8WWxnfD:Hq17j1gSGTz9oIxvlOS63W1D
TLSH
T12BD63347A70E1CDD5E68B48180F52AD497AAAE5CB45071256BA3379D080F9E42E3FCFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Patch.and.Keygen-R2R/REAPER_KeyGen.exe
- Size 12.8MB
- SHA256 2e3ab84f9027cd830782c973250d0ec700fae62137d82abfb474a965aba270bb
- MD5 9741f60f5974a08469f177fa69183cb7
- SHA1 1ea07a01657083e44f3ed434266a343ecc0b46d1
- SHA512 b0bf078b9feb6a5d3cea98bc0c81bb74d60b45d5bce325eaeacd2d3cd83f87472adb9ae0f0e5b2384c203bfc62cc6d9f642c980e2cf7fb1e54dbc2f0d72499ee
- SSDEEP 393216:sq/85vziqdqIdQJluIF3MnG3Vdl5DnP/vYPeH8YH:sqk5vziQJdQt3MGTDPYex
- TLSH
  T158D633B0A3D33BDADE520134801A789CC9A37C011B62E59FDE4535AE0F776942E7BE64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2