949a1a677993f9b873c4736d6bc1be8186f473505d56b38713d2a8408f44088b

General

Target
NH CREATION SAUDI PF 52.JS.js
Size 5.0MB
Sample260709-qfwcpscs4w
SHA256 949a1a677993f9b873c4736d6bc1be8186f473505d56b38713d2a8408f44088b
MD5 d9b48706e3ff23d11fee19fd5291e135
SHA1 b7e2f1e1b4b4db9ef3d44225786ecac2848220a5
SHA512 94ea0fc322df904670f16c576517fcade105a9adb4c2a12f89b770541a231b439aeda0edcae051aca07bdd87b0141c1144e057d173f9762dfad5d389d41cc969
SSDEEP 98304:oZrygEM+htBgjwyY5eICcVO9BnlGWT7v3FEgTmvBQUJL5vkLOM48VllbbhnfTZ9/:c+XSz9cgJLT70vBXrvkLBDV3bBBnfZ
TLSH
T1D8369D4C0369E3C761ECDB69C90ABEE91B4EA41B5C70DE08396D897C994CF0677583A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NH CREATION SAUDI PF 52.JS.js
- Size 5.0MB
- SHA256 949a1a677993f9b873c4736d6bc1be8186f473505d56b38713d2a8408f44088b
- MD5 d9b48706e3ff23d11fee19fd5291e135
- SHA1 b7e2f1e1b4b4db9ef3d44225786ecac2848220a5
- SHA512 94ea0fc322df904670f16c576517fcade105a9adb4c2a12f89b770541a231b439aeda0edcae051aca07bdd87b0141c1144e057d173f9762dfad5d389d41cc969
- SSDEEP 98304:oZrygEM+htBgjwyY5eICcVO9BnlGWT7v3FEgTmvBQUJL5vkLOM48VllbbhnfTZ9/:c+XSz9cgJLT70vBXrvkLBDV3bBBnfZ
- TLSH
  T1D8369D4C0369E3C761ECDB69C90ABEE91B4EA41B5C70DE08396D897C994CF0677583A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access discovery execution spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2