59b21e9cc08c5d6a845eb8eca79d507dd3615824aabe8b667fb554e926f46f2e

Sharing

Copy URL Twitter E-mail

General

Target
idman642build64_.rar
Size 25.5MB
Sample260809-rafkqsygla
SHA256 59b21e9cc08c5d6a845eb8eca79d507dd3615824aabe8b667fb554e926f46f2e
MD5 05d67f57593af990b3febc9710b5cd12
SHA1 243c6d685f6f56fca0fb29a9b0d4d0cb9f2015b6
SHA512 f1dc3766e96cc8b2fc837ab2b205c023cc83c7c68c970c2535f131e0f9aeb8f481d12c26fc2a7635f6967daa709be3596a96839968feffbf3975824ce7a78341
SSDEEP 393216:9knsFlvuwwpnMS9asvW+y7MDRjze5Z2aUX7zDa9ocu0U3yNHuKfnmHWmTrKNgc:KSlWwNJ+y+e5Z2auDaWb0U3qmXTrIb
TLSH
T11E4733F586AF4008ADA335A1DE43F8055EA093D4EFE1F3742CB246DA6AD1CD546E24F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Fix/IDMan.exe
- Size 5.8MB
- SHA256 c3b99b8812bb6168794582bc1afcac9bd8dcd1cc61b3c23c6a56b6339c62d45b
- MD5 4965f7f297fce41ac2556067b722f03e
- SHA1 450d10b825f6973bd1ad16a9fa4de31e5d5d7ca8
- SHA512 6fe1661836e23aeef1c1e58e5e8e89510112e66106fc360fcb7ba2c835238d4530e372a628311c5e4653f987c681a3f89f5a120ceb88f083117a018a8251d308
- SSDEEP 98304:6+/mEfM78Z4CfoCCPaP4Vhc18frP3wbzWFimaI7dloOY:a01Z47V7gbzWFimaI7dlRY
- TLSH
  T19E569E51BF8C817AC95A1531072DAF2A402ABC98773465D3B2743E7EEC753C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2
- Target
  Join Telegram for more.url
- Size 130B
- SHA256 970dfdac6e4da786167be4432834ecda2c81ef8182529c2325dbeb9caf31bf2e
- MD5 cb33842079e21618d7f4fa3cc09f9cd1
- SHA1 fea3d2fd206edf20ebdb7147464a269911d01a68
- SHA512 9b9086ae12313ab898f2947513167158988a52e823b86b986e8b1608bf05635ddfeeee1df1a2034b29c71523e9de7bd2df9167ebe22271d610317faceddc7dc7
- TLSH
  T14BC09B5F4505434ED241E44550B0F904948E75A56CD2D05C5248DEC71CD90D6C845B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  idman642build64.exe
- Size 11.9MB
- SHA256 2613854939069bf9338e79dd8dd94ed2ff4258e3aa0e768fc0ca904f2f094edd
- MD5 58e7299cc418093e8cac14880618a44f
- SHA1 966dac71abd843e894807edfed82cac8ab0e927f
- SHA512 ca6215295eb373cad48f7216f8edea2f1af7557e65d70f5df993be4e891fa6bd7476e7681fe2d1a2679ed275f27190d053fcd8881ab3e3dbe020c3f0575dd00c
- SSDEEP 196608:zDb5pg+o9wpfd5FRCKIKhQWJNY+SUtUz1CwrCcf2f/eG9OZqRvZ0FkD2pegNBWnm:z5Zo9wVF4KIRSrY13CVfP4ZoukKpvXSo
- TLSH
  T167C633CFB4A2CA5FE6E85878CD76C93998143C46EB080343BB6A3EFE35B51979045436
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  idman642build64f.exe
- Size 11.9MB
- SHA256 02933c70840aabd6b0a700128fa65b7b919ea5f8d2085b470d180965e496a387
- MD5 7af612c5464071c18ec5d7ffea8d41e5
- SHA1 ce8902da9b6e59f55debe09b2d99cf11b4ec8b82
- SHA512 ffc1c3a6a839b11a4522bde1d19b868e608a09543cd5747d7f2afb37a39abc54cbdad8ea20fb875a7a028385946eb4641b508345d52bb341fa718651dea8153e
- SSDEEP 196608:J6b5pCq6nDF/9r8lZS+vYDhxVmhQWJNY+SUtUz1CwrCcf2f/eG9OZqRvZ0FkD2p8:JwAqc9r8lZL6xV9SrY13CVfP4ZoukKp8
- TLSH
  T12AC633CFB5B189A6E98C58BCCD3680B699153D52EE0803D3B73A3EEF38B51865545833
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence privilege_escalation spyware stealer
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8