42b20899a2473c0e56120ca61a6d758eb6ec20c36cd79675a71316488a40dc06

General

Target
Launcher.7z
Size 77.3MB
Sample260724-2hskdaee72
SHA256 42b20899a2473c0e56120ca61a6d758eb6ec20c36cd79675a71316488a40dc06
MD5 c967a29e3aedbeea17d6baf87f75a461
SHA1 addc1d2af0f2843aaf28343871159e274875933d
SHA512 e9fb38df3dbcef739bc71008419a1125b532dab2b5f0a313a01a27b4b21b94c18d6688c53526e4d1ca4bfd8c0dfc8027e68185cb817a0d7d85bd116492871628
SSDEEP 1572864:IBvi3xJlkOHmR6QGoIGUQwYLkTvHfXenUMSV9FB/usk+n5t8QY0VJ9p5:IJi3BBxfoJL2WUDV9H2sk65Xf5
TLSH
T1D308339A7E22F07EF453E473E01463E5A25AE559D733CF96103B81CDF8A2A107B841A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Launcher.exe
- Size 77.4MB
- SHA256 ed434cc3022f225b57faba2a9ec099128157c73386c3ade07469229e7f7bb57c
- MD5 42e61358569a1eea9088df18808525b9
- SHA1 584a045ffc234dd9cb4d9f92cda06623c8640e4c
- SHA512 89a6684bd50c481f82ab836c1cfd21c6ebcd6294a74085041583d6688836c820d87854f9b36989d9cc9c2d735c61c01be97ba366080c9a469642c8847bd99a4c
- SSDEEP 1572864:dW2um44Hiht88zg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXye:dWTm4vcl9NYJo+sUifljLcs22/4
- TLSH
  T18C08338ABE22F07EF453D473E01463E5625AE559D733CF97212B81CEF8A2B106B441A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
- MD5 df2352fff1deec3d9690c5957093130e
- SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
- SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
- SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
- TLSH
  T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2