ba6b103cf16facf977dca1c7f674f4f53a7a577afdcc80f86f7fc6a713383ae3

General

Target
FletcherSMP_LauncherV3.7z
Size 110.5MB
Sample260803-prn74ay1bw
SHA256 ba6b103cf16facf977dca1c7f674f4f53a7a577afdcc80f86f7fc6a713383ae3
MD5 c491e9613f8d0c5029c53b23e9031e51
SHA1 593c0e2820de221062d0de3f725b290d5ffa2628
SHA512 f4d2d00300177469708329ba9eb251192b590664bd186fd2ce92fb8830c04a8c3fc514584f7f83017e3f45c8644114f73508a13e040145a29f1257aed8d68562
SSDEEP 3145728:0bGYanc4f7qYLlymRFvYYG4na75xkrf6Sm:0PancwqYZyOv3GOqxsffm
TLSH
T1974833CE4115605FE886FFFF4DA0E1BC38FD6731AE18822E507E95BA549C8D21641A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FletcherSMP_LauncherV3.exe
- Size 110.7MB
- SHA256 a606fb3783ee1f993011154af65849553b412ebe3e230882c38302f51e81b7e7
- MD5 0e064a9a7ea96d31092266653a47d41b
- SHA1 d336674225f023f7dd41bc6ddb520f31fdf9f6e1
- SHA512 5d51a8b81167e2d0f60d5a9fccd56c1f47bd3d33c68808d8f38d51c3bfaa27039400eac0cd6704f227f81894299c55d5241f476a9014ebdae7bd32f3570a730f
- SSDEEP 3145728:lG44lnFZ1iqdz/gU3736zVq6w38N66gcHVj:d2nFZJdz4Ur6Jqns6lc1j
- TLSH
  T1B04833CE0215E05FE586FFBF4DE1F2BC28FC93217D1C821E947A55EA54ACDC52A4092A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  FletcherSMP_LauncherV3.exe
- Size 212.7MB
- SHA256 8b816055d5b661198dccbe361597b226097034e66626047d965c6d18c6a9d92b
- MD5 835367b2d08ded23df031cb7e56f8553
- SHA1 bc4ca53251d8fede8a341e51a265cbd7e9dab49b
- SHA512 74eb2f4cc4edae74a45b9ff0e087d6f517b093faaf3a97e9bc7768a001ce4c55efcf7e4cd37fed4b37dad9f821302fedc2a573b322b8f64be1ad692562191f79
- SSDEEP 1572864:VYOueq/jLLjV4Z1A3IddZPFR7oFoTBY1UIxCsGimyApMMPsTEVtccEAzdFkAEcBP:kjIoF4dJlzR
- TLSH
  T120B88B03E29A41D9C05DD1755B5AA233FEB1B8054B24B2DF2BA447522F76EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2