d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a

General

Target
d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a.exe
Size 16.6MB
Sample260720-pt6vxscw6s
SHA256 d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a
MD5 227f18692929b5441b4af3c8e3cb1b8d
SHA1 f1f9cab1210ae1d49a150c625f212b787213026c
SHA512 3b8c0e306eca74d97ef0e5ccf873f34d55f2585f4f690a22eb6fe31979f6ca71bf95ca88d7b908adbd6d9e1175d238ad1ce0b65fb5a181b24b8d96a44216349f
SSDEEP 3072:0LehWQuIwB/rsfvGWz++hxSzDSx9MHSWtGLHVr3mJLMHQwgDyun7gtwGbebkA6Ko:rklhWphxSCxmyWQpr3e4MDyuGpby6t
TLSH
T11F075C0B7FD5D659E9A53B7BC6FB090007B2B5D24131E3092B0996F64D81233BE1A3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a.exe
- Size 16.6MB
- SHA256 d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a
- MD5 227f18692929b5441b4af3c8e3cb1b8d
- SHA1 f1f9cab1210ae1d49a150c625f212b787213026c
- SHA512 3b8c0e306eca74d97ef0e5ccf873f34d55f2585f4f690a22eb6fe31979f6ca71bf95ca88d7b908adbd6d9e1175d238ad1ce0b65fb5a181b24b8d96a44216349f
- SSDEEP 3072:0LehWQuIwB/rsfvGWz++hxSzDSx9MHSWtGLHVr3mJLMHQwgDyun7gtwGbebkA6Ko:rklhWphxSCxmyWQpr3e4MDyuGpby6t
- TLSH
  T11F075C0B7FD5D659E9A53B7BC6FB090007B2B5D24131E3092B0996F64D81233BE1A3AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection discovery execution persistence privilege_escalation spyware stealer
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2