b00d6bc2d7795bd36074a73a7922e9adbe7c5d6dadef9632da68d2e162285d39

General

Target
2026-07-08_1c79dd173a1bb103f91c61d3283c546c_hive
Size 5.0MB
Sample260708-2kzfpsa16s
SHA256 b00d6bc2d7795bd36074a73a7922e9adbe7c5d6dadef9632da68d2e162285d39
MD5 1c79dd173a1bb103f91c61d3283c546c
SHA1 89c7fa549830b4ce5cca54ef02b0f0824c51c864
SHA512 0973247b1c5a26e790e7db95c7b9b979a7c4046af79ca178ca677d7905e75160db1fcc6326e567bc8002b383b8787098cba25821cc2ecec42159120effd4e187
SSDEEP 98304:eOJ9FJzOXgcf5jm4vbCVjG7QihJ4ZBSvuiTcLJulRlAWtnwk+3N0tEmucbEcs:h93zUs4GVUQiv4fSvuQCJKRxtwl36tEv
TLSH
T1643633BFEB164E09EFCC8EF375500898E3E88909A915DD68C1C6916FF08E2D66477361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_1c79dd173a1bb103f91c61d3283c546c_hive
- Size 5.0MB
- SHA256 b00d6bc2d7795bd36074a73a7922e9adbe7c5d6dadef9632da68d2e162285d39
- MD5 1c79dd173a1bb103f91c61d3283c546c
- SHA1 89c7fa549830b4ce5cca54ef02b0f0824c51c864
- SHA512 0973247b1c5a26e790e7db95c7b9b979a7c4046af79ca178ca677d7905e75160db1fcc6326e567bc8002b383b8787098cba25821cc2ecec42159120effd4e187
- SSDEEP 98304:eOJ9FJzOXgcf5jm4vbCVjG7QihJ4ZBSvuiTcLJulRlAWtnwk+3N0tEmucbEcs:h93zUs4GVUQiv4fSvuQCJKRxtwl36tEv
- TLSH
  T1643633BFEB164E09EFCC8EF375500898E3E88909A915DD68C1C6916FF08E2D66477361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx adware ransomware
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2