eb29037a3f829dd5efc6b467699074eef87671eb72b16826cdf3bf857c98082a

General

Target
SteaMidra-6.5.6-Setup.exe
Size 275.2MB
Sample260731-dx4n7aam2s
SHA256 eb29037a3f829dd5efc6b467699074eef87671eb72b16826cdf3bf857c98082a
MD5 e8bd1a5340d443f57326e581b1c8aad2
SHA1 f96eb7d1f0c3382afd82088bdb9a8a8b782fad6f
SHA512 cc55baf1462156702ed28c0b127fe197723ab7684323e87b62623e42550e74a90b3a6ff286b7aff9e22c7162e8d3267bf9a047134515b2b6d45e8a10ac075bc3
SSDEEP 6291456:R7eVqQ/05kVsklfC5ghAd2s9HArcih5vaRLGB:k5Mmskl6wAd2SbSyRLGB
TLSH
T198D8336DE92AB928E89D043D706DE610BE1FCBB3F6BA070859D3E195E4807C850D4F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SteaMidra-6.5.6-Setup.exe
- Size 275.2MB
- SHA256 eb29037a3f829dd5efc6b467699074eef87671eb72b16826cdf3bf857c98082a
- MD5 e8bd1a5340d443f57326e581b1c8aad2
- SHA1 f96eb7d1f0c3382afd82088bdb9a8a8b782fad6f
- SHA512 cc55baf1462156702ed28c0b127fe197723ab7684323e87b62623e42550e74a90b3a6ff286b7aff9e22c7162e8d3267bf9a047134515b2b6d45e8a10ac075bc3
- SSDEEP 6291456:R7eVqQ/05kVsklfC5ghAd2s9HArcih5vaRLGB:k5Mmskl6wAd2SbSyRLGB
- TLSH
  T198D8336DE92AB928E89D043D706DE610BE1FCBB3F6BA070859D3E195E4807C850D4F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

google defense_evasion discovery execution persistence phishing privilege_escalation pyinstaller ransomware spyware stealer trojan
- Renames multiple (6135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1