de630ffa7ccef5880dbe8735eec06dbcbfb56ae415d63fe3674d18a584facb25

General

Target
goxlr-utility.exe
Size 123.4MB
Sample260805-as6ffagn3t
SHA256 de630ffa7ccef5880dbe8735eec06dbcbfb56ae415d63fe3674d18a584facb25
MD5 fb9d565c16303f3f6afab34e9b0a663e
SHA1 0f5915aef662bda1979aa71806f79ab41b8eb46e
SHA512 3c1b7c84a4b6cca5093f2a2008becdeeda1468d922fef68f1d8489b4b2954cb09ab0df58ea2dc534cd37403ac52d9113041cf57a301908181f650cec5683c1ae
SSDEEP 1572864:n6zuLINumgj69xX6Y831wdsmG9CmDEB5n2VNrTkCErBAxLlb:n6zcmgmfKGsmwCK+ofkCyqVlb
TLSH
T1AF58011663E111AAD577D138C7AB6203EB72B40B13308BDF329C47652F63AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  goxlr-utility.exe
- Size 123.4MB
- SHA256 de630ffa7ccef5880dbe8735eec06dbcbfb56ae415d63fe3674d18a584facb25
- MD5 fb9d565c16303f3f6afab34e9b0a663e
- SHA1 0f5915aef662bda1979aa71806f79ab41b8eb46e
- SHA512 3c1b7c84a4b6cca5093f2a2008becdeeda1468d922fef68f1d8489b4b2954cb09ab0df58ea2dc534cd37403ac52d9113041cf57a301908181f650cec5683c1ae
- SSDEEP 1572864:n6zuLINumgj69xX6Y831wdsmG9CmDEB5n2VNrTkCErBAxLlb:n6zcmgmfKGsmwCK+ofkCyqVlb
- TLSH
  T1AF58011663E111AAD577D138C7AB6203EB72B40B13308BDF329C47652F63AE45E7A760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer persistence spyware stealer trojan upx
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1