2fc8887bb3de8dbdbe293e5d32fb05f3da18931c605fb2c26cc0c199fb2c7ade

General

Target
PokeLauncher.exe
Size 132.8MB
Sample260729-pmxzfathpg
SHA256 2fc8887bb3de8dbdbe293e5d32fb05f3da18931c605fb2c26cc0c199fb2c7ade
MD5 424d6612de0d1e12c69c6ea86570c544
SHA1 7163aac10ca759a7f76b41eeccd973eb71b15a92
SHA512 e3c7e43582ce4ed952b3796c0afc81bc1a033361e5df2437f70ce8765bafe72b71273fb3cfd4e69f1d00b02a831d3091329f8914885bb0f91d689b5ae850929c
SSDEEP 3145728:K4/yjMIC4dp1SRnVdXXSeN9pnozE/qLHCVkIrOuYzlf:ijMIVDSBVpJmA/0iKRx
TLSH
T1CD6833B5F77028E8CF52CFBA0B2868506B3C5FA301E969E9687BB59D70F2170594E113
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  PokeLauncher.exe
- Size 132.8MB
- SHA256 2fc8887bb3de8dbdbe293e5d32fb05f3da18931c605fb2c26cc0c199fb2c7ade
- MD5 424d6612de0d1e12c69c6ea86570c544
- SHA1 7163aac10ca759a7f76b41eeccd973eb71b15a92
- SHA512 e3c7e43582ce4ed952b3796c0afc81bc1a033361e5df2437f70ce8765bafe72b71273fb3cfd4e69f1d00b02a831d3091329f8914885bb0f91d689b5ae850929c
- SSDEEP 3145728:K4/yjMIC4dp1SRnVdXXSeN9pnozE/qLHCVkIrOuYzlf:ijMIVDSBVpJmA/0iKRx
- TLSH
  T1CD6833B5F77028E8CF52CFBA0B2868506B3C5FA301E969E9687BB59D70F2170594E113
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  Lumora.exe
- Size 168.6MB
- SHA256 34f2252399a696b4625c4fd7a0394ae27dd1186c2cbfc572cd71afb9e7769683
- MD5 676aff6c7d4ebff1d76c1923503cae0a
- SHA1 6d626b79223e9a295d971c1d035778d326e8f886
- SHA512 5dd9de006f1b9d87c0837a698f02b2d6e277a1a841bf7f4a12337030c79b95743500b7f6c084a129947318bd66ba8119189c7fafd77d553e134f6dc7a780bf91
- SSDEEP 1572864:kOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:WgmeNxNNZxqV
- TLSH
  T156887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral2