9fa7510d4c2a36318b894113ea42896d26e1d8cc0dc88f22c7994f5b4edb5002

General

Target
WiFi_Password_Revealer.rar
Size 2.5MB
Sample260715-clafjact4s
SHA256 9fa7510d4c2a36318b894113ea42896d26e1d8cc0dc88f22c7994f5b4edb5002
MD5 31c981fa8b93b9f83a8747e2f44898f2
SHA1 37af6d2e953f593e89964f277f463790cb43d816
SHA512 c4880c79df426e6c822e77be5d2ed41128e5848ccefecdac7f30b63f1837c28b82351c20bc0192b885db115d921998270ff533e028edfc691390849a94d3eff5
SSDEEP 49152:g4yt4KsuLe7AXUWUZtVWtaAKBY9yPWlTRG8Ri3:s9sCeHW1ap69yGTvi3
TLSH
T183C533AF7E8E5346A6A146B290E7C7090C57DC427CC2C9097AD73AC2B3091961F6CD7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WiFi Password Revealer/WiFi Password Revealer Installer.exe
- Size 188KB
- SHA256 4257edc0eb3851cdc31cbab4f58c6990496e9d144684f25bad03f0ca131b750a
- MD5 8bdf2c6cd57dd3d1f11326ad20e02285
- SHA1 aaa62a3610b0844184ecbf7e99deed716ee38fe8
- SHA512 cf0d83bdbe7057089976f0660d0d3bc7a5ba7a51c1fd216a1da96a2fd6d92c9e7f6d6df51a74bc2a51a41ba9a4cf592c9f1b84741ee27abb565a6d4d43b39570
- SSDEEP 1536:i4lhePJ7bv//g6A0a6mNgO6VCZI7uTanqY:i4lhIg6ASKTij
- TLSH
  T145142E77344525E2F93D5BF12BC6AAB65ADE6E7F1CC0499422DC31F9A0B6220819C13F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution installer persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral1
- Target
  WiFi Password Revealer/skci.dll
- Size 293KB
- SHA256 1289b9be8bffd154540731758128e404d91ca3b17cf74288a389cfd14a0f353a
- MD5 ed7cdf7961ccfb400025e3c4ea52ff36
- SHA1 f9a68650cc1e8dd0319c44d5f1cebda318449fc4
- SHA512 4b0c0a4d7bca997f2e0839ccbc46ee890dce8de24be7efa90050fb98b7e70d6a845b4c895208dfe87d0520d7f8829c9635a6139ccf0498f32f2bb2159a1e3bc6
- SSDEEP 6144:HyAriYDte1yMA3GmD8by170h0z4A/hNj/WMWn:SoDw1yZ3G7by170h0z4A/37
- TLSH
  T146543B16B2E419E5DCAB84F8FA268561EE70B8070354C7C7D790CA680E1FED1ED3A746
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  WiFi Password Revealer/tcbloader/Ionic.Zip.dll
- Size 480KB
- SHA256 17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89
- MD5 f6933bf7cee0fd6c80cdf207ff15a523
- SHA1 039eeb1169e1defe387c7d4ca4021bce9d11786d
- SHA512 88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6
- SSDEEP 6144:OhagC/Mq25o9sXGtSV41OJDsTDDVUMle6ZjxLV/kHu4Bht79I9:iagxWS4msNUCe65fkHdBf9
- TLSH
  T183A4AD0427E90A55F4BE5BBAC0B69260C3B1B4166D6FD70F4EE020EE2D37790D9147AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  WiFi Password Revealer/tcbloader/Launcher.exe
- Size 53KB
- SHA256 0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32
- MD5 c6d4c881112022eb30725978ecd7c6ec
- SHA1 ba4f96dc374195d873b3eebdb28b633d9a1c5bf5
- SHA512 3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981
- SSDEEP 768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5
- TLSH
  T11B332A489A4C9773C9ED46BE98E366904375C02B6B47E70FBC8982345E133EA194279F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral4
- Target
  WiFi Password Revealer/tcbloader/wfs.exe
- Size 2.3MB
- SHA256 6f37eda632e5bf3bf4db10f9a635dae20714b16fe9200bf25fe390d8a40120be
- MD5 e1373a5a5c19b706823ba7fb468dc382
- SHA1 de3aa0d85c0f8a9784c9f2a7d7f1727900e0c8cb
- SHA512 a13d15e34b56c43bd60d1acb398d1b068e0b7e3273dba4bcc43404496335ee85a5b701cbf1e1c284c01859673ae203cdf02024dd68892e1a8ec4b806ea3a846d
- SSDEEP 49152:W0qUp3UrvSZb5uVcC3hwNw0VCo0Q9l9jnsJX2FYn3tlLS6TQj2qdrhLYWsP+R7Ov:Tgr6Z1uVBhHMCvkVemFcDNOdNBj+g2
- TLSH
  T175B56AD05A85A9A8F4A18333B913907BCC122C57F4E074D27BE1EE5E6B62C6CD577283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery installer
behavioral5
- Target
  WiFi Password Revealer/utils.js
- Size 68KB
- SHA256 83c365463d1dac75dcd3b680a27029153fdb8d604aafd1ea41505f758432603d
- MD5 cfb29417369701aec017d482796a3451
- SHA1 b0001b07a96d68c130b160c16ecbf2594f26118b
- SHA512 3a124c0056afaf958be14f40c9beed9da322a8993bedb753180c61b651adecd35e2b598b89a5db3f5525d53836c2e50a081722552caed981c72423b6ea36b332
- SSDEEP 768:x9yuWxkDckvabCdj8KvwX9SevOX953/aZq50X+rn5V/M/+b9+dclbuEuHCceBdU4:x9zckvaAMay85uHCXyPEPErafz
- TLSH
  T12C63A70D7ED712B7751324782B6BA480F314D50B6138EAA57C9DA2D46F40B3852FEEE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6