13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680

General

Target
13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
Size 37.6MB
Sample260719-3alyasas2v
SHA256 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
MD5 cd5108fa41f02dc29296654d6fec5b5f
SHA1 f07c771bf5e3aa1e97ea1e1254b8b3089c910905
SHA512 2fce6ed94a174154b87e0a6449fe7c8fe0796c0cf75b32b97eb8a4c45ecad6cc7d907e0eaffa8a66a11e9c97550ea64ac9266a81a36ea7608f1942dbdff77f13
SSDEEP 786432:F3on1HvSzxAMNgFZArYsxbY3WLET4CXubf:FYn1HvSpNgXmxiDT49
TLSH
T13887AE03B2A501E5E4B7D1388AA74603D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
- Size 37.6MB
- SHA256 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
- MD5 cd5108fa41f02dc29296654d6fec5b5f
- SHA1 f07c771bf5e3aa1e97ea1e1254b8b3089c910905
- SHA512 2fce6ed94a174154b87e0a6449fe7c8fe0796c0cf75b32b97eb8a4c45ecad6cc7d907e0eaffa8a66a11e9c97550ea64ac9266a81a36ea7608f1942dbdff77f13
- SSDEEP 786432:F3on1HvSzxAMNgFZArYsxbY3WLET4CXubf:FYn1HvSpNgXmxiDT49
- TLSH
  T13887AE03B2A501E5E4B7D1388AA74603D772B8674731CACF325D02161FBBAE09A7F765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence spyware stealer trojan
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2