443aa5c658ba5e04b57d6ae8789e2863dfe73b5478560e57b3548397516ed0cd

General

Target
file
Size 326KB
Sample260803-axxdbsaa23
SHA256 443aa5c658ba5e04b57d6ae8789e2863dfe73b5478560e57b3548397516ed0cd
MD5 5e1fcd9add62606a4433e7a65aa78129
SHA1 e4118c9abaf7ef0cd6b97deed52ce676bfdeac9c
SHA512 824c505a5330b695cb0cae8a7a712bf781b36c0a028eb6950736084117af6af9efa93aed1ce08de3325d3462397a35b4cbd20ea685a3ec2c424bc2969437ffc0
SSDEEP 3072:LY2gAkHnjzxQ6KSAiTdH/88aW+LN7uxRLlzglKpf2Ltl:xgAkHnjzxQBSAgf88CN78Bpf2Ltl
TLSH
T1CF643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5E5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  file
- Size 326KB
- SHA256 443aa5c658ba5e04b57d6ae8789e2863dfe73b5478560e57b3548397516ed0cd
- MD5 5e1fcd9add62606a4433e7a65aa78129
- SHA1 e4118c9abaf7ef0cd6b97deed52ce676bfdeac9c
- SHA512 824c505a5330b695cb0cae8a7a712bf781b36c0a028eb6950736084117af6af9efa93aed1ce08de3325d3462397a35b4cbd20ea685a3ec2c424bc2969437ffc0
- SSDEEP 3072:LY2gAkHnjzxQ6KSAiTdH/88aW+LN7uxRLlzglKpf2Ltl:xgAkHnjzxQBSAgf88CN78Bpf2Ltl
- TLSH
  T1CF643C25E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5E5AFD19862177B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1