7d77f09e2c36b088e774ffd64e6af0aea3ed1478ee65f0f3723792c129c0ea2d

General

Target
psycho.exe
Size 32.1MB
Sample260718-ynqq7abv2p
SHA256 7d77f09e2c36b088e774ffd64e6af0aea3ed1478ee65f0f3723792c129c0ea2d
MD5 2f27768727c0c48c4a78c5a6d03b9f38
SHA1 fb002615cec67638ef7731c0d03c4178b8915910
SHA512 f586021890ad0d072f53f003d508973f22a3e2511cf306f45d0864eda050ec64d26bde8a9e5ce19a4ec5635acba0d1c7f36642cd6348d7ab2bb7913e276b9a93
SSDEEP 786432:2TW8eI6OCC2j6+s7LWB75zuD0LhX+2iQyR:MWFbOCC2qHWB75igLl+t
TLSH
T12977336573C984F5FACBA439D18106622AA2749413B0C69F8BF50D221DAF1F9FE34277
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  psycho.exe
- Size 32.1MB
- SHA256 7d77f09e2c36b088e774ffd64e6af0aea3ed1478ee65f0f3723792c129c0ea2d
- MD5 2f27768727c0c48c4a78c5a6d03b9f38
- SHA1 fb002615cec67638ef7731c0d03c4178b8915910
- SHA512 f586021890ad0d072f53f003d508973f22a3e2511cf306f45d0864eda050ec64d26bde8a9e5ce19a4ec5635acba0d1c7f36642cd6348d7ab2bb7913e276b9a93
- SSDEEP 786432:2TW8eI6OCC2j6+s7LWB75zuD0LhX+2iQyR:MWFbOCC2qHWB75igLl+t
- TLSH
  T12977336573C984F5FACBA439D18106622AA2749413B0C69F8BF50D221DAF1F9FE34277
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1