3d6909ebc0479e1ff4dc33b8f135e7065adda8835b13b2621ade113bcf625171

General

Target
JumpMaster3000.exe
Size 298KB
Sample260719-ejjyasbt3p
SHA256 3d6909ebc0479e1ff4dc33b8f135e7065adda8835b13b2621ade113bcf625171
MD5 ac9fc1320b50f620af226e99f4f28eec
SHA1 be028b8e3e3a0266ed883e6653ef86197bfbd44d
SHA512 4671cf6aa0aab6448f28d34c3680879cd83da80774f80c678710f861067d86e21963eb6e8a3c5e5138f232ab10d8645dea6a28c9270e1ebb464525efd0c6fa37
SSDEEP 3072:S5Ps5WwabiIUkc2HlxYT08z6u7Mc7MBa46JZWP4jAU4yzW9:uPuabmFJM
TLSH
T1335400439D7444F6DCE133B57BA29A1029927DDF4433862D03D6F87B6D6F9CA1032A8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  JumpMaster3000.exe
- Size 298KB
- SHA256 3d6909ebc0479e1ff4dc33b8f135e7065adda8835b13b2621ade113bcf625171
- MD5 ac9fc1320b50f620af226e99f4f28eec
- SHA1 be028b8e3e3a0266ed883e6653ef86197bfbd44d
- SHA512 4671cf6aa0aab6448f28d34c3680879cd83da80774f80c678710f861067d86e21963eb6e8a3c5e5138f232ab10d8645dea6a28c9270e1ebb464525efd0c6fa37
- SSDEEP 3072:S5Ps5WwabiIUkc2HlxYT08z6u7Mc7MBa46JZWP4jAU4yzW9:uPuabmFJM
- TLSH
  T1335400439D7444F6DCE133B57BA29A1029927DDF4433862D03D6F87B6D6F9CA1032A8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1