64dc7e9176fd171c79a7cd612f0058c1acd15654734da0ca64f359898b43d700

General

Target
Real_v2.1.2098.zip
Size 2.6MB
Sample260718-nzbrasdw91
SHA256 64dc7e9176fd171c79a7cd612f0058c1acd15654734da0ca64f359898b43d700
MD5 791f97f4556407cff9cf7c01a7777802
SHA1 b0ae406f954e93e7340ffbc890aa31b1012bb499
SHA512 f84bbbd9401357ace0339fa27c020e753ed5ae9cdc63b4faffe169a5f459e0821492f27cfdf1a35a2e3afcb0061450184f4a142119a1a6a2094a3438a4a030af
SSDEEP 49152:vH/hROONzfgRurhekRkm5RHRfnw0d0GC+L2cyugBMf5WbLkcclUpHv9c80ROgO0M:HmONVrZRk8RHRf92GJ2fu8FbAcaOHv93
TLSH
T10BD53351351343AEA2649CE778A27474144B7EBBAD63AE82CD8AC11039474E7C1E9CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Real_v2.1.2098.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access discovery spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  mpclient.dll
- Size 5.1MB
- SHA256 077a433f33683587df1ffa8337fc86fef0d51cfc30c7c9e1ec9ccac6323e3957
- MD5 cadcc65304e93e5c86dd9f6cf464db41
- SHA1 1f2c561f48b21bcad0bc07447668b40d6383a22d
- SHA512 0b02c5e6732055c7553efeb037a6388b99c7f168007fd0d3c333f1d561bfa976cbf09ee1766844e754aa681540977c40cfe73ca206003f495d63e5713814cb0b
- SSDEEP 98304:S0MpQgeo8J3Ztul25wpVPq6s8aPR7lPgGRDyw0yu:S0Ueo8J3Ztul25wpVPq00ZgGRDyr
- TLSH
  T151468D07FF9145A5C899E23589B292027779BC4A077733E72D60AA393F367D08D39B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2 behavioral3