b63368c5977e77018d488c6076f21b6ce901edbec7c2bff3f0e9aa98dc6a25c8

General

Target
megadupa.exe
Size 21.8MB
Sample260808-nl22bsel8v
SHA256 b63368c5977e77018d488c6076f21b6ce901edbec7c2bff3f0e9aa98dc6a25c8
MD5 b8fbf309f2c4b8cefdbfee5a3cbaaecf
SHA1 0ab6872b6f6f33a808e0673577a8454da2c5a46f
SHA512 3f87562e4c460eb806fde24aa5b3365f7895ad7b197b23e422a4ebabd3e7c3c9314aafd7515018eaa595b73b5432821fbf5b901a94c216d6ba8fe2c7485c1775
SSDEEP 393216:IDq/vElNIZ37UJ32eivEoxy8ee+XEAphVtl510MjHe61tOqzkzajsmvAr5u5N:IDq/sbS4ce2s7e+RphT10Mrenqzkzajh
TLSH
T1243733587B1211FBE5E4483A59BAC853B3E331874B6492AF0BA0253B2F779E41D3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  megadupa.exe
- Size 21.8MB
- SHA256 b63368c5977e77018d488c6076f21b6ce901edbec7c2bff3f0e9aa98dc6a25c8
- MD5 b8fbf309f2c4b8cefdbfee5a3cbaaecf
- SHA1 0ab6872b6f6f33a808e0673577a8454da2c5a46f
- SHA512 3f87562e4c460eb806fde24aa5b3365f7895ad7b197b23e422a4ebabd3e7c3c9314aafd7515018eaa595b73b5432821fbf5b901a94c216d6ba8fe2c7485c1775
- SSDEEP 393216:IDq/vElNIZ37UJ32eivEoxy8ee+XEAphVtl510MjHe61tOqzkzajsmvAr5u5N:IDq/sbS4ce2s7e+RphT10Mrenqzkzajh
- TLSH
  T1243733587B1211FBE5E4483A59BAC853B3E331874B6492AF0BA0253B2F779E41D3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer
- Adds policy Run key to start application
  persistence
- Drops file in Drivers directory
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  cheaty.pyc
- Size 163KB
- SHA256 f241cd82560d65646f2479fd269670258385733d38fc4f72e9e2cf0127540116
- MD5 7d5734973e6c9f750a961f071bb9e184
- SHA1 322ee900fc2a7529bf2e49c6c27923164fc41a2a
- SHA512 f43c910bacd5ecacb1d23be6b92f12452e7c2d0112bc57f2253a210428423521417e8594bc48927e562371d2064b156aed5d580b0d216599579cc65b8e73a6cc
- SSDEEP 1536:FaKMwbnVO1Le0ij67dLAN6njVCKh3N/H3Zml33iWrMs2qATpTizKJ9ZC2+z6G1Wb:tidM+kl33iuAVTaKfZCtz6G1Wb
- TLSH
  T1F1F309BCA634A527EED8B97831D2ADC5A3328285B201D747F028CCB8FECD319D55525E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4