8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535

General

Target
MBAM Patch (MALWARE!).7z
Size 64.9MB
Sample260807-mfl79awvax
SHA256 8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535
MD5 18cdb4710669e0c9bac728158a950469
SHA1 93ba0dd1884c985f00a4f64e8b5117e0b84b560e
SHA512 dd09aae99e246d4d92220344062623398c51481ebcdbf0c123f2f453ae089478a9c85b5a37296f179bc4e22796ef2260575545d270b95201584b9b9e3855c40d
SSDEEP 1572864:Y4EavAhHKdwIaY+Oyt28Pjr+lvpFMr7Es114EnxxIUXGUDYgynHBg0DAk:Y4Ea4hHUohjr+lsss114EnxJYgynO5k
TLSH
T1C0E73355A9A58749727100A2B7B0587C9960B3FBFAAF4D4CFD8E4BC8B4060E074927F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MBAM Patch (MALWARE!).7z
- Size 64.9MB
- SHA256 8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535
- MD5 18cdb4710669e0c9bac728158a950469
- SHA1 93ba0dd1884c985f00a4f64e8b5117e0b84b560e
- SHA512 dd09aae99e246d4d92220344062623398c51481ebcdbf0c123f2f453ae089478a9c85b5a37296f179bc4e22796ef2260575545d270b95201584b9b9e3855c40d
- SSDEEP 1572864:Y4EavAhHKdwIaY+Oyt28Pjr+lvpFMr7Es114EnxxIUXGUDYgynHBg0DAk:Y4Ea4hHUohjr+lsss114EnxJYgynO5k
- TLSH
  T1C0E73355A9A58749727100A2B7B0587C9960B3FBFAAF4D4CFD8E4BC8B4060E074927F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware google defense_evasion discovery execution installer persistence phishing privilege_escalation ransomware spyware stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Drops file in Drivers directory
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Detected potential entity reuse from brand GOOGLE.
  phishing google
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1