a53704d1cbb3df303205f39f2444d2d4718a2c1b94465448c59a0ef6eeb16fd0

General

Target
KitsuMCLauncher.exe
Size 67.8MB
Sample260802-yxtjfa1dna
SHA256 a53704d1cbb3df303205f39f2444d2d4718a2c1b94465448c59a0ef6eeb16fd0
MD5 aec2408f35d68770a0d8e9fbd781d683
SHA1 db0cab4baddb1a94152cb27d99bb1a294d9ccf79
SHA512 d427271e9f55e4f226cd1d5b9031d885765d20100bc2511819b022e5baa42e6e15d199d3bc6de9e2faa686340284035c3154cdb49ccb7ef4c34731eae73bc138
SSDEEP 1572864:+ejOYfgZr0QQD5WSecEldBRzZhNSKb85sqSUDV8j1+rPX7:+4EZAecElrRzQKbFNUDV8j1mf7
TLSH
T1B9F733ECBABCCD30E4C46574E22627781E6DEDC316AF2A4CBFBE4C5532658058748E58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  KitsuMCLauncher.exe
- Size 67.8MB
- SHA256 a53704d1cbb3df303205f39f2444d2d4718a2c1b94465448c59a0ef6eeb16fd0
- MD5 aec2408f35d68770a0d8e9fbd781d683
- SHA1 db0cab4baddb1a94152cb27d99bb1a294d9ccf79
- SHA512 d427271e9f55e4f226cd1d5b9031d885765d20100bc2511819b022e5baa42e6e15d199d3bc6de9e2faa686340284035c3154cdb49ccb7ef4c34731eae73bc138
- SSDEEP 1572864:+ejOYfgZr0QQD5WSecEldBRzZhNSKb85sqSUDV8j1+rPX7:+4EZAecElrRzQKbFNUDV8j1mf7
- TLSH
  T1B9F733ECBABCCD30E4C46574E22627781E6DEDC316AF2A4CBFBE4C5532658058748E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1