12d98ec43fc599fc243f8d2dc4e01d5d06e7227ac426c89e207a6e3ba83f7874

General

Target
Real_v2.1.22195.zip
Size 2.5MB
Sample260807-hydavaef22
SHA256 12d98ec43fc599fc243f8d2dc4e01d5d06e7227ac426c89e207a6e3ba83f7874
MD5 c471ee209e44f9cf41825798416dbe20
SHA1 f6c06c2631660a944fbcb7a4c3854df48ec90426
SHA512 19344cb2fffeab728673fc3c9fe801d46e3f2f570ceedec314ab11090364c1e8305fa76f0a52881c539301b8e9d17a04904da6e7ada830cd7a8d4180c0633f19
SSDEEP 49152:4H/hROONzfgtH4+OcyhZBn/JxS5nn2zpZ0xfyHkz:wmONY6hZ1/3S5nOpZ0xfyA
TLSH
T189C53392B6A74069D0733D92E1C1F635AE8D7A9DC1E40AA8D4538337668F15E0EFF342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Real_v2.1.22195.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  mpclient.dll
- Size 5.6MB
- SHA256 9da90d850c78ef90b4964813b0239864fe0e9e051b118ac0542f6cc6ecb62671
- MD5 ac35ce3944a12f65d28a791d4b6f9369
- SHA1 2666d70ea924eeb079c21b0104a3e2a4e21659d9
- SHA512 33a9a8a131780dbefe60221d65d03fa201172a3b9c14dd3afd858b11da8936d42e9505adc9e2648178439f99a8fb3475a0df190f37d818a956684241f12b66e6
- SSDEEP 49152:e5Ff/ZVbggn6IgdrW51dr54j2cKMYvA+HEht3q3fby+SKlcP79WAPGXkRgVOIheA:eTXmKkTavITgkRgUmeTi/WSU/9dZYf
- TLSH
  T131566C03E95545BAD0A4E332C6BA8356B629BC4D873437A31FB1AE782F32BD16D35710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2 behavioral3