c49d948fa9a51832f65a144d0eda71de414bfe299a0c5d4d3b262bc34a8694ce

General

Target
FueagoNeuxs.exe
Size 6.7MB
Sample260727-ytmlqa1vgw
SHA256 c49d948fa9a51832f65a144d0eda71de414bfe299a0c5d4d3b262bc34a8694ce
MD5 83c9cd57e918fdc9b8f9b7181aafd789
SHA1 0af5c158fdc4b39fd8b37e8281b96346e6bb6458
SHA512 3df17a5d5c3f76efe8a99ada434f38c05bf6ff6149fb41264da0c587f137dcd8ee0f6c4a672572838f3536ad79d410beab6c2b33a70878e67f0f428fc1c4588b
SSDEEP 196608:zrou2nZ+8lcEybVV3zymx3BYVoaXzLCk6rkMktY8mRooFk:zrkZ+L3DzN3BYVnzWkd2ooFk
TLSH
T1C566333200B0E563DEA1237AE4C6E49BCD20385D56D01F47E7D92271B7B2B4693EA7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FueagoNeuxs.exe
- Size 6.7MB
- SHA256 c49d948fa9a51832f65a144d0eda71de414bfe299a0c5d4d3b262bc34a8694ce
- MD5 83c9cd57e918fdc9b8f9b7181aafd789
- SHA1 0af5c158fdc4b39fd8b37e8281b96346e6bb6458
- SHA512 3df17a5d5c3f76efe8a99ada434f38c05bf6ff6149fb41264da0c587f137dcd8ee0f6c4a672572838f3536ad79d410beab6c2b33a70878e67f0f428fc1c4588b
- SSDEEP 196608:zrou2nZ+8lcEybVV3zymx3BYVoaXzLCk6rkMktY8mRooFk:zrkZ+L3DzN3BYVnzWkd2ooFk
- TLSH
  T1C566333200B0E563DEA1237AE4C6E49BCD20385D56D01F47E7D92271B7B2B4693EA7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1
- Target
  FueagoNeuxs.exe
- Size 7.0MB
- SHA256 60c778af88fba073c5409c12070d3d2b2527830a64d100d444ceffe4ad370ada
- MD5 c6ed17888ebe2d3241bdde90804dddce
- SHA1 110e1b98d1b5f73392b7fa91b865f7e6ec702525
- SHA512 dfa31b969b7ecd99f8236933c5330c5cba97192eaad081ea30bc3b35a5bc2675ce3ddf495daacb88c7a17f88cb9a127ff7db41481cc871694b4b9e85a9ec4df1
- SSDEEP 196608:kBVzhticsvEV+ANUaj3h+yLFGhbgkn5f2pIyc:0zhT4CNl3h+yEhJOpI
- TLSH
  T1D47623BA524437ACD45E88748423FC45A1F6611E1FF99A5971EBF6C03BAFC10EA42B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Windows Portable 64-bit.exe
- Size 64KB
- SHA256 4b316291bf9bf7a45f4ddd012151d3157876fdc4a3b818c1729ce13344bf4d98
- MD5 de9d9dc1b09fda4c799103a1da38aeb1
- SHA1 20adcb8af658ce023684f2cf897a5b2ea8086ca2
- SHA512 f65a9e39dfaf614e403603b34728f3a21986ad7923c14779aba8bc972f394476b808d2b620ae722417535c64b714e30d4bbc5b86e39d0ae7cc7530629bb5f9bf
- SSDEEP 768:h44CUqXbw9xotfv6ksfT+OJE5ER1fVqxSs7956tHYVmq7N9XoMOwQP:hnqrwSZsn27Ss7956tHYoLx
- TLSH
  T1F453E50966ED9422F2BECB7D69B40212C733B4F65535EF9B4DDD90991BA730029C0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral3