60ef26874cf0e9b8c48896e7366364157d22ed9b07b327b5c26a866ea10507f0

General

Target
SolarJumpTrial 5.32635.7z
Size 151.5MB
Sample260801-n9mljsac39
SHA256 60ef26874cf0e9b8c48896e7366364157d22ed9b07b327b5c26a866ea10507f0
MD5 de0b9fc0f9c96259c71d28fcecd5b85f
SHA1 ca882c849bf047cef16beffd6a446ee18e8c303e
SHA512 9a073ac77dbb3a6574c93f838ee09359f1481e2a6bf46e3821158f5cfc4c005000ca3ff4f4a20449905bc929f2c062700fed0c6f45770eabe33974bbdc7c1384
SSDEEP 3145728:15aWkgxJ9k4KsvsDMTqBzozZvQG32Ag0PfpWwXRPBKDvzwwK7l9oGw4dd:MoTk4p0D+UQvlfJRsM77lqBq
TLSH
T1647833BC74706E79F8A8FCDE1944AA3CE553B0659963E162445D0183F8EF4D30C6AABC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SolarJumpTrial 5.32635.exe
- Size 152.4MB
- SHA256 1909e57fc476c17f38c43995289cb3d40dd0d218c935b18453fe7fd584928686
- MD5 b7abcb55176100f155c1e9fe1bace6cc
- SHA1 797b8531a0f588b26bb4fb8d240863521b55751f
- SHA512 58c96f74a08e96838064a53207fec04886d84b42f762fdeb40f639ec0987dc408900960909e42d0df4de61b95324f37c766b7b121ce7b0a593ab6780e2d75cdd
- SSDEEP 3145728:WgYGVMPJf5FF74m4VA3rAtmCI+ki5NN5ABFJToZZhLCsiPF2FKQzi1Pj1RolA5QL:v25d4VWktLkQNtZri5QziFj1RRa1
- TLSH
  T12E783354BBB01DBAF854FCFA9A50663CD2A3B8B10693A825145D0183FCEF0D619F993D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  setup.exe
- Size 221.5MB
- SHA256 5117df4038b08093c84146718b0a24cfaa1e34d04b1de0456cda6291a4ea8b10
- MD5 0c12156ed770a4b629298ed21c99a0c8
- SHA1 226b11d88d2f889149e67510aeaf7d912f16a55a
- SHA512 e251fe1f8ecf58e6d675e19444520e3b0b6c81c2f3c8d2c3341cbd174c2f2c17549e5939b7f0802d992cedbbdb1bda6249c9a48e5fa432b5747138d2471320d6
- SSDEEP 1572864:j6s3R+1OrrQQrHzz/HNBnhOuKb3aynBZS+OdF9/f1FlKVROhJA0lf9MQyRUHuJTQ:On1Ofrv5GttDl66w/
- TLSH
  T1DBB88B03F29A41E9C01DC1799B5B9633FE71B8454B24A7DF2B5407922F66EE82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2