Extracted

Extracted

• • Target
    newuiv3.exe
  • Size 28KB
  • SHA256 40af137afb37711ecf2b89883c938e41b74f6aebee1e1c89259c663a384d4e29
  • MD5 138f63c43ba0515b51ec2db000c01a68
  • SHA1 3e5936050dafd2e156362a56f48f192dc22020c1
  • SHA512 a8da65cdb3d7a0ae3f8af0fb0071e3923d2d04d6969d9c5143774ebd2eaa36781ede6f0e21687074d84d16a7c435025fea32e53b833cb4c67ae48cd489457c49
  • SSDEEP 384:M7bIL7OMAXoT/JHZg+wS9qKm0NONg80SYHcVn0PlIR+CVPffW2cJnME:QbI3p/J5g3UPmdq8yHcKA9VNcJZ
  • TLSH
    T154D23C0387B846F0CA15D5BA479CA326F172F898637835CB1BE41F511B90BE06F36B96
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdropperexecutionpersistencepyinstallerspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2