996eb82fd67c9fb9f30c1d55d4ea535f899d1d31ead4c1e5047cf0f6c4c7e4f3

General

Target
BBRWSetup.EXE
Size 38.3MB
Sample260727-1z13eade59
SHA256 996eb82fd67c9fb9f30c1d55d4ea535f899d1d31ead4c1e5047cf0f6c4c7e4f3
MD5 2064629fbc25b586d72b835af7542520
SHA1 9b83698e9275a8d3cd67116c2c304332341a5572
SHA512 bb7a21f2991241f72fa9cc7bd1850b265343f01d0e978657d5c8ae30be292d63d134356d799d1f7c24779dd6e56b674adaa6865037f10e3c2ecd5ef004c3eca5
SSDEEP 786432:xIvj8Hp+ZFpCvj8Hp+oRSAz4K8MZVF5qnUZmZ17lHBq6+qAy:xEj0pIOj0p7t0K8YF5NClBq6VAy
TLSH
T1009733B25823A59FF4B07EB22191A79E49587C6821735CFDFFA04B4888B11F5C6F9E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BBRWSetup.EXE
- Size 38.3MB
- SHA256 996eb82fd67c9fb9f30c1d55d4ea535f899d1d31ead4c1e5047cf0f6c4c7e4f3
- MD5 2064629fbc25b586d72b835af7542520
- SHA1 9b83698e9275a8d3cd67116c2c304332341a5572
- SHA512 bb7a21f2991241f72fa9cc7bd1850b265343f01d0e978657d5c8ae30be292d63d134356d799d1f7c24779dd6e56b674adaa6865037f10e3c2ecd5ef004c3eca5
- SSDEEP 786432:xIvj8Hp+ZFpCvj8Hp+oRSAz4K8MZVF5qnUZmZ17lHBq6+qAy:xEj0pIOj0p7t0K8YF5NClBq6VAy
- TLSH
  T1009733B25823A59FF4B07EB22191A79E49587C6821735CFDFFA04B4888B11F5C6F9E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery persistence spyware stealer trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1