efac8698fe6ebfb16fca66c6442352591079ef82ebdcfa6cfe95291b2b15eea8

General

Target
KippoApp-1.22.333-setup.7z
Size 57.5MB
Sample260811-qq99lstfmf
SHA256 efac8698fe6ebfb16fca66c6442352591079ef82ebdcfa6cfe95291b2b15eea8
MD5 2f6017449cfcb7eca11fabbd7aeb8da1
SHA1 e27c14b7bf0b4044fe3a3a1f8bfc609fc20c38c7
SHA512 b4e1a767007bfe3129c3307c554c2f7c8d2a29ea8fba6b11a4b259830e5d133ef0acefd353b82e8369188dadb94b66df89ab70703df2f11c97d281fc5cfe37ae
SSDEEP 1572864:gr22fDe/OEAwFz2581/G56we7+zPQPyEhCrKT:R2fDCOEFp081QAqw
TLSH
T19AD733857E05262DDFA88AB6ECC154341D8DA79234C893ED36A963FEC217419E4FC336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  KippoApp-1.22.333-setup.exe
- Size 57.8MB
- SHA256 7ac38b9717f9ba42d91c532138facce0e1a6d54d7d9c41224d851c7ca23bdd5c
- MD5 a352453dbebec7217e46ebd8e96711fe
- SHA1 deb59d791991ab3d49de23cfef64722160e563dc
- SHA512 6fb994b50c457e96a30e89663b4a516d76f4a5a35b87bd5463aad73762287123865f668f54528b8b026d6196721ab4c22b46d65db6c8d60ed786498bbd8473cb
- SSDEEP 1572864:iZHV1JDcBQdhA4gZJ/fJoWsOeUxTecValmIs0:ilV1JYBQzf0J/mj+A
- TLSH
  T120D733477E05152DEE944A7EB89C04340F9EAF9224C8D29936977FEEC237065E0EC672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1
- Target
  KippoApp.exe
- Size 125.0MB
- SHA256 2792032f8e8f9744c750a98fa37f23752319af59631c723a3ed27e43e95f8a31
- MD5 bdbde6fc0a79f2ed0960576abc8c9721
- SHA1 5320a897f3ee14d0af08750fa8549a04c556076b
- SHA512 0a3a77eeb034c009e7a60b682c8d3050c5b5b981fe912f5b0e40c4195e85359907f3caa5e215f7a4f619b495e7cf24eab7332458c225118682b3bcfe61f01147
- SSDEEP 1572864:XgHsrD2MoMg3MxuD1whA4n+eeQWGKu4dYscEWuiLhUFhcWK2H:XwmylD1w64nk54bqT
- TLSH
  T1F7588D03F2A610DDE05CD1769B4A8636DEB1B8464735A2DF269127162F7BFE02B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral2