880befecbb9d0b862d0bfc9cab4fcb7c3556ef6380610f4e7a029cc7ea8499c3

General

Target
Elite.Level.Account.Manager.Setup.2.0.0.zip
Size 73.0MB
Sample260808-yep4astdla
SHA256 880befecbb9d0b862d0bfc9cab4fcb7c3556ef6380610f4e7a029cc7ea8499c3
MD5 58f9a37b60a49d39613c934d3007f80a
SHA1 d2b10098175eefdcaae482417d7b27531dc60896
SHA512 3f0db2f32d6bc64406879562cbeba8f5046562754cf7f6c51a67d457019608772338a66d5a11e8d84d389ee9ca0db5a56152003473d7eaed4ca0460e5f8a9232
SSDEEP 1572864:CGe4hdV6xfHH1I0LynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJYi:CGe4Doxfn1ITI/0A/3/vHLosEKi
TLSH
T1B9F73363AD3E09FDD0D5B77ED56F04F5864B284F098E10A972BF91AB78F85060E2118B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  Elite.Level.Account.Manager.Setup.2.0.0.zip
- Size 73.0MB
- SHA256 880befecbb9d0b862d0bfc9cab4fcb7c3556ef6380610f4e7a029cc7ea8499c3
- MD5 58f9a37b60a49d39613c934d3007f80a
- SHA1 d2b10098175eefdcaae482417d7b27531dc60896
- SHA512 3f0db2f32d6bc64406879562cbeba8f5046562754cf7f6c51a67d457019608772338a66d5a11e8d84d389ee9ca0db5a56152003473d7eaed4ca0460e5f8a9232
- SSDEEP 1572864:CGe4hdV6xfHH1I0LynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJYi:CGe4Doxfn1ITI/0A/3/vHLosEKi
- TLSH
  T1B9F73363AD3E09FDD0D5B77ED56F04F5864B284F098E10A972BF91AB78F85060E2118B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Elite.Level.Account.Manager.Setup.2.0.0.exe
- Size 73.0MB
- SHA256 f6fa2d9f0a2bf7efe15ec8beb4dea02a57ed9cc2c8becaa1f274e358c8c68ecf
- MD5 dd11b2ec4b19977efa419063c2b20dd0
- SHA1 ae296d274c50a5eb88f1da25defb97a53d451198
- SHA512 0b22f60dcc5ecb39c6cdabccf2ab050d00a562e3e524dda1854db581c143659edfc4aa1f4e9e5d7e57290bb1dc003c3875b4b0a3fa90b2a09362a12331aac98c
- SSDEEP 1572864:1Ge4hdV6xfHH1I0LynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJY9:1Ge4Doxfn1ITI/0A/3/vHLosEK9
- TLSH
  T131F73363AD3E09FDD0D5B77ED56F04F5864B284F098E10A972BF91AB78F85060E2118B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral3 behavioral4