06ace83b53a3ea433a87e35dd38f4f6aa274229789a8a79fa29358703e011151

General

Target
Madium.exe
Size 67.0MB
Sample260720-ff57sshy71
SHA256 06ace83b53a3ea433a87e35dd38f4f6aa274229789a8a79fa29358703e011151
MD5 61ab56bd0b79b9dc10f815c007c7860a
SHA1 86fcd70a33a3a01f7172b2711a5212bc237bfdca
SHA512 ed3a90d07c572b2fb8e9f185b9cff7112bb5f5ad7780643b214e66e238703da971548e72b5d9d884dafaf8b963888434dcc0f5c7a944949052654f3fd32f91f1
SSDEEP 1572864:AqrTIA1z+vWlM9ojCrD4WWJvKSc/JUNnRPhhOThccJjwj:5WelKbDSc/iFROFq
TLSH
T1FEF73304CE00A7C7D4E8C132D680DEA4F89A5EDB2A53955317E0346C3A7F3C55E69EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Madium.exe
- Size 67.0MB
- SHA256 06ace83b53a3ea433a87e35dd38f4f6aa274229789a8a79fa29358703e011151
- MD5 61ab56bd0b79b9dc10f815c007c7860a
- SHA1 86fcd70a33a3a01f7172b2711a5212bc237bfdca
- SHA512 ed3a90d07c572b2fb8e9f185b9cff7112bb5f5ad7780643b214e66e238703da971548e72b5d9d884dafaf8b963888434dcc0f5c7a944949052654f3fd32f91f1
- SSDEEP 1572864:AqrTIA1z+vWlM9ojCrD4WWJvKSc/JUNnRPhhOThccJjwj:5WelKbDSc/iFROFq
- TLSH
  T1FEF73304CE00A7C7D4E8C132D680DEA4F89A5EDB2A53955317E0346C3A7F3C55E69EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1
- Target
  main.pyc
- Size 41KB
- SHA256 890d2ea32d237c667abd5f3b64891632de1d51211402f7a93b660ae511e46b05
- MD5 45e761dd259c5eabc0d3f001c8adc86b
- SHA1 cac2f2e00ee21c8d863dbe9da0927e0c7505c26f
- SHA512 eb7fe3e6cf11f4c344f506d1fdd11471402abcea221d22859ec0ef3a2c33e91f3d380703e158cab280a494ea367aa7bd417d83ecff88a5b3d872d63052368b1c
- SSDEEP 384:T+2Q7JjXKHob1ppMrm3U9aEybkeoTeWvbrdjrS8vrgvJlkPSBqXO3W396EpfxzF:TdmuHipSmvEyb63U8vrgv3kCBa6gfX
- TLSH
  T19013E7B9A870E977E9D8F53831D398D57321C285B251DB07E0185CBCBCCA306EAA572D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2