Extracted

• • Target
    KMSAuto++.exe
  • Size 26.0MB
  • SHA256 4140061e52a95ecd9e6c9f55e8a18f7fb1f0605fb26e1d8236eaf0dfda04e866
  • MD5 d02f15eb9d0c8cdb597d5b892a8aba86
  • SHA1 b8344bb2157669389119be005b74c45d5adcbe7e
  • SHA512 47cdd36ef62be7a48d8d80a08fa9cdc3ce2a7176c26818baf1626270633c072a790b41508d179c15f488d831ab439ab0baf47211d1d8a3e16b312a2143fd6328
  • SSDEEP 786432:su2+/t6D6dbsDTOXFTXRkdObGXYztTHMa0:A0ZBkd4zZMz
  • TLSH
    T1DD57BF11EBD200B0F5B39670C9BAD236CB377E154632CD9FB24C598D6B33680997A726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecredential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • OS Credential Dumping: Security Account Manager

    Malicious Registry Hive Dumping.

    credential_access

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1