e7fbdb4368c48b09403a7b8fc91b5f7d2220f2cd42a2b6577aab596395b1ae46

General

Target
index.html
Size 272KB
Sample260708-tvev2sct4n
SHA256 e7fbdb4368c48b09403a7b8fc91b5f7d2220f2cd42a2b6577aab596395b1ae46
MD5 cd54de541fa83df444d752bf7e6ffe0d
SHA1 8c3cf99344a8aa2b5db91111fa15c7b3d453869b
SHA512 05f1727b526f00cdc4857cee4c5dc27df0bf85735c085980a1b4ed86ec4994869f527718ab26213fe2eb5f381a8e5c88ea15c3e81218e3a2863404967cfae981
SSDEEP 6144:2CO8gAHWNcIGyUbc4aBBU0s0AkYKIychS+YjBInf8HYPD:2vgHWNcInUw0clY0g4YPD
TLSH
T110549DF03960BDC92A16856AA057BD9E179106BB1CBF14A1D6776EE107BB30FC82B4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  index.html
- Size 272KB
- SHA256 e7fbdb4368c48b09403a7b8fc91b5f7d2220f2cd42a2b6577aab596395b1ae46
- MD5 cd54de541fa83df444d752bf7e6ffe0d
- SHA1 8c3cf99344a8aa2b5db91111fa15c7b3d453869b
- SHA512 05f1727b526f00cdc4857cee4c5dc27df0bf85735c085980a1b4ed86ec4994869f527718ab26213fe2eb5f381a8e5c88ea15c3e81218e3a2863404967cfae981
- SSDEEP 6144:2CO8gAHWNcIGyUbc4aBBU0s0AkYKIychS+YjBInf8HYPD:2vgHWNcInUw0clY0g4YPD
- TLSH
  T110549DF03960BDC92A16856AA057BD9E179106BB1CBF14A1D6776EE107BB30FC82B4C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence spyware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- System Binary Proxy Execution: Rundll32
  Abuse Rundll32 to proxy execution of malicious code.
  defense_evasion
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1