94e4b8fa6e8bd678eaf283f17f5354b3c7159bd8cf9eb24ad1058eb8aaaa2bd2

General

Target
Tom pearl ddoser.rar
Size 1.2MB
Sample260809-cbn6yaybmd
SHA256 94e4b8fa6e8bd678eaf283f17f5354b3c7159bd8cf9eb24ad1058eb8aaaa2bd2
MD5 f8466630dceaf3f97c4ae80164e74ced
SHA1 df7eb0a218771cb757c930ddc95f8f964205a89c
SHA512 4c0f8f38e1fbd380cfc57b577013e316d0d66389e8701d073acb78264eab63d06539092e8c2654b9d49cf7f915a08506ffc5698102b2e1a8f8454c291029ccf5
SSDEEP 24576:Nj6zpawVY5LzFU7Cr55DzzMK2IZRuSwvRw938Oicv+N:Nj6NbaUWrzDzzx2GRuDA3O4U
TLSH
T1C545337A47F60ED5F14471A0588947B25DB8A0A3DFF2A8D50F2AB89E46CB71BDB00335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Tom pearl ddoser/Tompearlddoser.exe
- Size 108KB
- SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
- MD5 8ce68a756995deb55746dee1525edec3
- SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
- SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
- SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
- TLSH
  T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Modifies Windows Firewall
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1 behavioral2