d5a808981c97840aa5e6c1c375445fd6d3cc8564945e03a91ebfe922fbb85139

General

Target
Panmena_BetaPlayTest.7z
Size 129.0MB
Sample260805-qffbgsybnd
SHA256 d5a808981c97840aa5e6c1c375445fd6d3cc8564945e03a91ebfe922fbb85139
MD5 7d7a51bc9cd8e20819c3c4c787df03e3
SHA1 4bfc6ae71890e2f8b782208059ae204d34173391
SHA512 e37dda2c639cac5b3d06697a065b39e51be0ce55e1b0a17ab67e8306fe622c5809a9a276bd53b514fcb8f25efe4b9eb3f96a544d282f5577361dd331a4db374d
SSDEEP 3145728:a/ey7GPWmRvnFl+ZidZdvEZcPrEpxiWwYaC9DT6muox/h:KGPZRvnF0Z6bLPrEpMWfaCUe5
TLSH
T1EB5833A9B633948D568E6E22CFB66710C95C3218759CA03BEE5FD1F831CC2132F985E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Panmena_BetaPlayTest.exe
- Size 129.0MB
- SHA256 cb32956261c5542737a729331d401da168f5df4235525edf6bdf951876f16ff4
- MD5 50df711fa707b311a12615695838d735
- SHA1 3fac16225dd74e94b196405b7a94844a595fd5ae
- SHA512 ab9662c3713a2843303073f9a272b1acc28d2e29ed6a4d42666eeb26b45688a40d1a7788d3bde8700dceed0bd8384689ccd18e3915af5fe701ae2cf3244b626c
- SSDEEP 3145728:KksMjAWqtp44Lnum+ZXnB7r7e8MDWvqJCmu9BWBEDR8BH7:FAWCp44LumMRze8MDqqMmuO15
- TLSH
  T1625833A9B633549DC68E6E328B766710CD5C3218759CA03BEE5FD1F831C82132F986E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1
- Target
  Panmena_BetaPlayTest.exe
- Size 215.0MB
- SHA256 87eef102c83c2c924488348666509afffd3948f10321aaccd2ac639edd588894
- MD5 3c25bb583717226223384bf99dfcea76
- SHA1 febd9ed70a11af952f6eda9226b3223c585172bb
- SHA512 a4b6b2fbac364b2eb6c1f5b7ce534cb01467cffe567918f6eb39bc2be0e623a021ce5f62176aa8ff412e80b5b911ae9c1d6b089435bc3fdaef05cf858f46cc8c
- SSDEEP 1572864:68uXmfmOYq0ICLp1Y/T0M7Sw0IEEvvVjIGnXiv4X1XfN4dlM7x1pYEUgb8D7TIjD:Bm4CNsP7/cK
- TLSH
  T127B88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral2