8f93e2457923e9bd6539fc20d6551ed2a243b2ca3473bbecd9b9f2dd41e920d2

General

Target
Prestigemovies.7z
Size 67.7MB
Sample260805-qggwpsgn4s
SHA256 8f93e2457923e9bd6539fc20d6551ed2a243b2ca3473bbecd9b9f2dd41e920d2
MD5 36196f090fd0b0e94c44eaf9971f764b
SHA1 a687c7d36dc636f0541dea2a00a36e9fb5199686
SHA512 2f93dbfd9140803a49dbf2d488f63f17145978842597fd6b32ebd39e874ef6856a2becb99f5d98dae7ebbed8ea667075081aa25f8ece40020d60567a9bd8baa3
SSDEEP 1572864:qIvDYOpEScIbihKUwN1XpxoRmlJiuKWXRC77Yuj7VcQDZf:qPrfI+h5wNHHwuKWXyZVccf
TLSH
T1BAF733F033E845D7D920F1B9A7209C3D5690FEE143AC841857A76D662F79E983B9830E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Prestigemovies.exe
- Size 67.7MB
- SHA256 da9dd1b2246cf4e5a154344ddd79ef7ec1848fc128082c3ca2df9004807cc4ea
- MD5 23406307ff581974ae39936c94e01dc4
- SHA1 9d248a577bba642c6bfaec651de8532c83b2af76
- SHA512 7c7e58a657058bc21fe8fea32a715bf06549ccc25538f5e5f2d835e87fc30f99cdaf25f471f52be03065d0a98e5e39bff6c8d04286c544cfe1872d1520d234a2
- SSDEEP 1572864:nejOYf3z03XgyhkxrBp4NOZt08W01WpHcCI1LZ7cd6nvUY7:n47QX/hmrBY0l1WpHQ4d6MY7
- TLSH
  T1AFF733F033E845D7D960F1B8A7206C3E56A0EEE142ACC51857A72D652F75E983B9830F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1
- Target
  License Verification Utility.exe
- Size 168.6MB
- SHA256 67dc2a7036860a68e5312c212c31b8772ac463ed0289fcc44897867f55075e89
- MD5 fbe2635ee2c0e774247127b54371b343
- SHA1 e1b2434bc210206da2e8f6f442c11de19b87a11d
- SHA512 2832fd5f238aa5d2b7c4ce3bfc81c71a3ea764ca596cc360fbd08270e1a885a9b5a2c6d21912d902997f70c675e6212cb0c755ddd6890becf22959205d9c06c6
- SSDEEP 1572864:vOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:DgmeNxNNZxqV
- TLSH
  T1E2887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2