f80e33a4f0589d5fa8a4d284f9f9cbd07ba3ac28c55a8d2c1dbaa73a12bd371d

General

Target
123.exe
Size 508KB
Sample260809-qb442sfl6x
SHA256 f80e33a4f0589d5fa8a4d284f9f9cbd07ba3ac28c55a8d2c1dbaa73a12bd371d
MD5 bda2ce8e72733b58002f1994dc952db5
SHA1 6474cd7b17a5d66244156849b4fb6e04371ac491
SHA512 99668b91cfc2fc867da7d1c138ec0e39dd4b9c8997cbb087dbb8607cda0c7472561d6bc815c412fd64b2495ca3395d231b78d964622e926704d3847c8d5875fe
SSDEEP 12288:KdANCUXYdPRoC6x1eUbh9TYHc0AkEUCWsyNCM2Tzv1NYOuP/:rToPRoCTAsCTyEzv
TLSH
T188B407287F998A08E580297E454E1615DBDAD1F126327303370AEF620D05DDEEE6D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  123.exe
- Size 508KB
- SHA256 f80e33a4f0589d5fa8a4d284f9f9cbd07ba3ac28c55a8d2c1dbaa73a12bd371d
- MD5 bda2ce8e72733b58002f1994dc952db5
- SHA1 6474cd7b17a5d66244156849b4fb6e04371ac491
- SHA512 99668b91cfc2fc867da7d1c138ec0e39dd4b9c8997cbb087dbb8607cda0c7472561d6bc815c412fd64b2495ca3395d231b78d964622e926704d3847c8d5875fe
- SSDEEP 12288:KdANCUXYdPRoC6x1eUbh9TYHc0AkEUCWsyNCM2Tzv1NYOuP/:rToPRoCTAsCTyEzv
- TLSH
  T188B407287F998A08E580297E454E1615DBDAD1F126327303370AEF620D05DDEEE6D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2