5f41e28eb656330356d8abb7ccb363024c12fddd4de26061a1666750ccb51d89

General

Target
PlaylistRoulette Setup 1.0.0.exe
Size 108.4MB
Sample260730-nktnkawfqa
SHA256 5f41e28eb656330356d8abb7ccb363024c12fddd4de26061a1666750ccb51d89
MD5 8aef48aeda95ff5396158c3178c7bcfb
SHA1 230198285dccbdd88d24f2e0b4eaa0b68ae9c413
SHA512 c20e50256ebfcd51959d125db5eb873e4fd0ba97f574b06de7cfb62d3cc0721de4bc9882c4d84f993f1b7526e7b11d5907dfae86952531d5703fe64e8a03368a
SSDEEP 3145728:q4QN6qnvrGzPqFdncBdyNPgKbHWL+mfL:y6qajWngyRbHWL+mj
TLSH
T1094833DCC4A2293DD8B9F43ED0DAFEA5054A70C55F506BC28A6E2EBD39924113E33719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  PlaylistRoulette Setup 1.0.0.exe
- Size 108.4MB
- SHA256 5f41e28eb656330356d8abb7ccb363024c12fddd4de26061a1666750ccb51d89
- MD5 8aef48aeda95ff5396158c3178c7bcfb
- SHA1 230198285dccbdd88d24f2e0b4eaa0b68ae9c413
- SHA512 c20e50256ebfcd51959d125db5eb873e4fd0ba97f574b06de7cfb62d3cc0721de4bc9882c4d84f993f1b7526e7b11d5907dfae86952531d5703fe64e8a03368a
- SSDEEP 3145728:q4QN6qnvrGzPqFdncBdyNPgKbHWL+mfL:y6qajWngyRbHWL+mj
- TLSH
  T1094833DCC4A2293DD8B9F43ED0DAFEA5054A70C55F506BC28A6E2EBD39924113E33719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Windows security bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  PlaylistRoulette.exe
- Size 192.0MB
- SHA256 67dd574d539d84664085d4155ec69655588ec882c883dd1af58e395087c92ff4
- MD5 2d0d7122ddd590c54227951bca289175
- SHA1 34ec49fffd905bde4154f81137f545aee356e7a5
- SHA512 67acbc41d3bbf1f9bc1dda842d93e4d3ee2e6252bfa3d36188b2f6d934ad1847135421903f5a5409c0038b927fff86504a2f63ab12b90bead14b0050ad24e785
- SSDEEP 1572864:5hqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709xz:oOMMpBKvPTJJlfwy
- TLSH
  T12FA88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan
- Windows security bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2