64ff7d1d6e9977de1d11372f969f799d2ee8bd3fafb8893446df7cf9fa8689b6

General

Target
InnerEvilLauncher.exe
Size 129.1MB
Sample260810-ra95caap6v
SHA256 64ff7d1d6e9977de1d11372f969f799d2ee8bd3fafb8893446df7cf9fa8689b6
MD5 b48cd1365bb78b3764228974940447fa
SHA1 ec06d65e230ddf171a0acf27b4886530781e7a53
SHA512 d6b06d5bbe53935a6cd3574a82b681f6f2db8b64e3e8cb1555ebca48fecc0be4999baee3316ac2dbbb371ab1146971bf9ae83ffd1017cb96271e293f7694cb69
SSDEEP 3145728:zksMtKfnO5jCSW+uz+nWMDO5cA7TyLPnfy2DMl436v7:zfmeSWhz+nWMDO5cAHKfy434
TLSH
T1605833AE14A9C702CF5EB73F74866B1B8B09380821F544796B6F778B713C92E68D9C50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  InnerEvilLauncher.exe
- Size 129.1MB
- SHA256 64ff7d1d6e9977de1d11372f969f799d2ee8bd3fafb8893446df7cf9fa8689b6
- MD5 b48cd1365bb78b3764228974940447fa
- SHA1 ec06d65e230ddf171a0acf27b4886530781e7a53
- SHA512 d6b06d5bbe53935a6cd3574a82b681f6f2db8b64e3e8cb1555ebca48fecc0be4999baee3316ac2dbbb371ab1146971bf9ae83ffd1017cb96271e293f7694cb69
- SSDEEP 3145728:zksMtKfnO5jCSW+uz+nWMDO5cA7TyLPnfy2DMl436v7:zfmeSWhz+nWMDO5cAHKfy434
- TLSH
  T1605833AE14A9C702CF5EB73F74866B1B8B09380821F544796B6F778B713C92E68D9C50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  InnerEvilLauncher.exe
- Size 215.1MB
- SHA256 d491b3391447bbef60befdc58a1ee47536d9ada0ca74e74c562da7c6746e29fc
- MD5 7339514f7bccf1914fc9f07e4b88412c
- SHA1 e63f3c1c85b8ceb1768fed69151e3b2c783049c0
- SHA512 a49752502cc94540def7d3c2992f490b885f65ec96175972e64d060fdf18d8dd3c940c448a105965efc01869f294f172cc7b2b8231b30a3aa381f906ff8a406d
- SSDEEP 1572864:l8uXmfmOYq0ICLp1Y/T0M7Sw0IEEvvVjIGnXiv4X1XfN4dlM7x1pYEUgb8D7TIjD:6m4CNsP7/cK
- TLSH
  T1BFB88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447922F66EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral2