46cfb0f7ae99fbc2c28fc2684b9750cbe711b79b677d5e623f90ec2c6c081b9e

General

Target
agent (2).exe
Size 13.7MB
Sample260806-gxddsavclh
SHA256 46cfb0f7ae99fbc2c28fc2684b9750cbe711b79b677d5e623f90ec2c6c081b9e
MD5 d5414e4af9cf72075ba9d0af55327471
SHA1 c77e1514bb8aeb64f9903be3074c97d25800b702
SHA512 a3862cdf1813554fb6394ca25fcf8a881bd1ed6bb9b99fa9bbbd0c10c42d1227e4b7d3b3a797bcfad8a263ea0389bb208b4247885386f22ed00273a735bb7d63
SSDEEP 393216:y4+mIHjnO582uCKhHTodRGkXMp74e3jAtw:RZIHLOSrCc0LhXMFT
TLSH
T11DE6336763CA86F8F967683805524140B2F6BC026B25E6DB23ED4953BD332F42D356B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  agent (2).exe
- Size 13.7MB
- SHA256 46cfb0f7ae99fbc2c28fc2684b9750cbe711b79b677d5e623f90ec2c6c081b9e
- MD5 d5414e4af9cf72075ba9d0af55327471
- SHA1 c77e1514bb8aeb64f9903be3074c97d25800b702
- SHA512 a3862cdf1813554fb6394ca25fcf8a881bd1ed6bb9b99fa9bbbd0c10c42d1227e4b7d3b3a797bcfad8a263ea0389bb208b4247885386f22ed00273a735bb7d63
- SSDEEP 393216:y4+mIHjnO582uCKhHTodRGkXMp74e3jAtw:RZIHLOSrCc0LhXMFT
- TLSH
  T11DE6336763CA86F8F967683805524140B2F6BC026B25E6DB23ED4953BD332F42D356B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation pyinstaller spyware stealer trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Modifies RDP port number used by Windows
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1