d889e0c12088087df3534aeac5bfce5a8dcb4d9aab1f836070901465f3a6a83b

General

Target
AspasSetting By Def&Zen.rar
Size 3.1MB
Sample260727-pyachsszas
SHA256 d889e0c12088087df3534aeac5bfce5a8dcb4d9aab1f836070901465f3a6a83b
MD5 3d613516af0a32f4bc0ea98dcf9728a6
SHA1 4ea1fdd19079ee56126fc0cc7ef7fb717af10e8d
SHA512 f49192f6119f219ab985b1de29fb94b2d30b4b79ba5b0d2be1888f7cf09c8e3e73fca7dd65cc01f304ccd93202ceb0a3f0eec8f0609f91cd2db4b8892dd2f57c
SSDEEP 98304:L8Py6ajxgi25/F+vxUOPkAeLdosZ0ikbToiiB3np70r:MyRKi2kn7eqsCi4ToiiB3G
TLSH
T148E5332736A2FE34E427DB7D6B7C8691ED10B24BCEE2C151371EE0B1985DE867204639
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  AspasSetting By Def&Zen.rar
- Size 3.1MB
- SHA256 d889e0c12088087df3534aeac5bfce5a8dcb4d9aab1f836070901465f3a6a83b
- MD5 3d613516af0a32f4bc0ea98dcf9728a6
- SHA1 4ea1fdd19079ee56126fc0cc7ef7fb717af10e8d
- SHA512 f49192f6119f219ab985b1de29fb94b2d30b4b79ba5b0d2be1888f7cf09c8e3e73fca7dd65cc01f304ccd93202ceb0a3f0eec8f0609f91cd2db4b8892dd2f57c
- SSDEEP 98304:L8Py6ajxgi25/F+vxUOPkAeLdosZ0ikbToiiB3np70r:MyRKi2kn7eqsCi4ToiiB3G
- TLSH
  T148E5332736A2FE34E427DB7D6B7C8691ED10B24BCEE2C151371EE0B1985DE867204639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware stealer trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Deletes itself
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  AspasSetting By Def&Zen/Aspas Setting.EXE
- Size 4.1MB
- SHA256 a5c0dca0d097efa62ba39b144a6a85352296babded76040ebaab76e255a9a451
- MD5 a33f1ebbadff20e336cbd8b80909c7eb
- SHA1 322ba73e5a2c01052d755ebb93f0cc9ac5830b2b
- SHA512 3ceb567efca0237e5d094a3f552019928f3876013025c00f911ad758bbd68fc9730bdab082fc5f7096efcab45802f9a7fc7c843f77dd14d6b929705266299394
- SSDEEP 49152:lqmfEfcnrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtc55:lEforzwUI5o9NniEoqDL412gF2eQP1I
- TLSH
  T12616E1A2D9C0E15CC663C1704D1B71019629B6FF27F8B1CABADE442DAF61B41CD27B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation stealer trojan
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2