56eed0637c680f54c55275b380fd56783364e3f57bc9cbf86450d13850d2a23a

General

Target
dotify (1).exe
Size 17.5MB
Sample260718-pch3jaaz4j
SHA256 56eed0637c680f54c55275b380fd56783364e3f57bc9cbf86450d13850d2a23a
MD5 09845dac9cff5156f7dbfcd59b387314
SHA1 704a1ecfb671244bd24dfab943913cd7e532d113
SHA512 5724ad77f0eda0d02cecbf1ee6a4a0128978aaee53e7936852c69026e25dc966f50fb2e6cf6f2100387d1c11aa557e75d415d757aef2dd096b6a085478a00425
SSDEEP 196608:qRDJHRawBgZjBDOrZx6P/BKQCVz6K+DTDO:qRDPgJWMKQ9KW3
TLSH
T122074A43F66291E8C169C075935AA233FB31BC4D47347AEB5BE04B223E65F906A3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dotify (1).exe
- Size 17.5MB
- SHA256 56eed0637c680f54c55275b380fd56783364e3f57bc9cbf86450d13850d2a23a
- MD5 09845dac9cff5156f7dbfcd59b387314
- SHA1 704a1ecfb671244bd24dfab943913cd7e532d113
- SHA512 5724ad77f0eda0d02cecbf1ee6a4a0128978aaee53e7936852c69026e25dc966f50fb2e6cf6f2100387d1c11aa557e75d415d757aef2dd096b6a085478a00425
- SSDEEP 196608:qRDJHRawBgZjBDOrZx6P/BKQCVz6K+DTDO:qRDPgJWMKQ9KW3
- TLSH
  T122074A43F66291E8C169C075935AA233FB31BC4D47347AEB5BE04B223E65F906A3D718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware credential_access defense_evasion discovery execution installer persistence phishing ransomware spyware stealer trojan
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1