60f441ab90dae5b786b7b86c6ac04721f987792727c05d882c6c9577fcd327af

General

Target
oioi.exe
Size 77.6MB
Sample260714-cslgdaex8s
SHA256 60f441ab90dae5b786b7b86c6ac04721f987792727c05d882c6c9577fcd327af
MD5 23e22343e33c94bb09aec3f55fc930a4
SHA1 5df6e72713bf54c28d3d9596f4200262b9ee4abc
SHA512 c0fbf302afb7aa4173bc52072f1d7e39a5ddc59a705775b307b484db7ba10799ff33ac24565543445852ef4a3ba14d44642efcf43a25abe222180c89db11bfd0
SSDEEP 1572864:G4f/8FkYEUZl7XNyjhQR5QMJJ8R/E0/utd0xygPhIOThxH6iZYkrody/w8X:dfmEQlLgaR55oR/E0/kd0xF5FxHw8
TLSH
T1FC0833C1BD4636F6DD9416306484AD3BD6E530894F53C29B1BF469362E2B780AFB0AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  oioi.exe
- Size 77.6MB
- SHA256 60f441ab90dae5b786b7b86c6ac04721f987792727c05d882c6c9577fcd327af
- MD5 23e22343e33c94bb09aec3f55fc930a4
- SHA1 5df6e72713bf54c28d3d9596f4200262b9ee4abc
- SHA512 c0fbf302afb7aa4173bc52072f1d7e39a5ddc59a705775b307b484db7ba10799ff33ac24565543445852ef4a3ba14d44642efcf43a25abe222180c89db11bfd0
- SSDEEP 1572864:G4f/8FkYEUZl7XNyjhQR5QMJJ8R/E0/utd0xygPhIOThxH6iZYkrody/w8X:dfmEQlLgaR55oR/E0/kd0xF5FxHw8
- TLSH
  T1FC0833C1BD4636F6DD9416306484AD3BD6E530894F53C29B1BF469362E2B780AFB0AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution persistence ransomware spyware stealer trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1