48448ad6f541be1fcbc38d43c5f72dafbbbe2adcf2fb51194369f23c430a2e30

General

Target
Criminals-Within.zip
Size 86.5MB
Sample260808-y4heradk4x
SHA256 48448ad6f541be1fcbc38d43c5f72dafbbbe2adcf2fb51194369f23c430a2e30
MD5 aed5f4762053edf89e03590bfa7c96cd
SHA1 3c0d11deb5cb496c7b7f6f8ba9a68232d3835a4b
SHA512 51b813f696b111431c54b250249d96762c693b7d6ee10b416129e95ca9374ad938e8636f8d3807a45bc615c3515070c769a87d021b24389cd1a8c11625dffe26
SSDEEP 1572864:UaJQc3DW+l+kzJPw5lm5leP67zRN6nLfhjFtIHF4tn0uefM33N+FbcVUO+QMhjLw:PJ/zW+lJlPweleP6AtjFeHF4tn0/M33L
TLSH
T1751833563FF48B2A606ED36F97A673932880B5971A50257E9C7BC8CD90D8F34743826C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Criminals-Within/CriminalsWithin Setup-2.4.1.exe
- Size 86.6MB
- SHA256 77d7a0bf48e923c21352d4f9cf273823c8bf1122fe8bd3ee637583c104ef6f41
- MD5 6571960569710cab15af1f2eb8c74254
- SHA1 9e59ce9ce10a8203179c3b73bc88bf4c155732ea
- SHA512 2282b59fcd80fba8a49ba755a389a8545b4127a67ed01f70a438ab77201d7ab2a068cd01fc62c798c8b83f4ac6fe006f62a6146c9b4d673a3cd474ac87c0d254
- SSDEEP 1572864:Ud+BWMFDe45kstLzSb1G6hDRpANnH7MZJ9HJLJ6fzoXzcA2fy7BlwhPyxQai6qHF:UUBFle45/dzSrhDRpA8HJLwfzoXzc7yc
- TLSH
  T10A1833452FB4CB1AD15DA33F93E6F3B324946E872D10526A8CE7ECCBB4A4F6474241A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1