30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa

General

Target
file.exe
Size 4.0MB
Sample260807-pcq35svdpg
SHA256 30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa
MD5 01f84e942908ccb2fc657d9dd1caf8b5
SHA1 c6cc775f76f0aced85206c313b452f29334c6ac9
SHA512 3eb0a647d6b5dc832ac58f2783aa58f3b44884adcf7040fe0030001b87df443773fd136dc45b52d4dc85f85faf593e58d8a6ef35d55735a40bced332c2f82495
SSDEEP 49152:or6eizASPXwsy0kCfMNsuNATM93rsvkENKT9iDMzwKo4MIwXZ8fhsQWLg5sR:oFfckCEtiM93rsvkEETBzc4MvCZwLms
TLSH
T108165A07BC9548F6C0A5A73189B74256BA64BC0C5B3233D72E60AFB82F727C06E75B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 4.0MB
- SHA256 30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa
- MD5 01f84e942908ccb2fc657d9dd1caf8b5
- SHA1 c6cc775f76f0aced85206c313b452f29334c6ac9
- SHA512 3eb0a647d6b5dc832ac58f2783aa58f3b44884adcf7040fe0030001b87df443773fd136dc45b52d4dc85f85faf593e58d8a6ef35d55735a40bced332c2f82495
- SSDEEP 49152:or6eizASPXwsy0kCfMNsuNATM93rsvkENKT9iDMzwKo4MIwXZ8fhsQWLg5sR:oFfckCEtiM93rsvkEETBzc4MvCZwLms
- TLSH
  T108165A07BC9548F6C0A5A73189B74256BA64BC0C5B3233D72E60AFB82F727C06E75B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution persistence spyware stealer themida trojan
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2