669939741aaabb0c0fae53d086c9b73f0fec749e3df294ced931b45e42012bd4

General

Target
InnerEvilLauncher.7z
Size 137.3MB
Sample260815-n9d96sfe99
SHA256 669939741aaabb0c0fae53d086c9b73f0fec749e3df294ced931b45e42012bd4
MD5 80e49425697808b5d96df98e77f51c12
SHA1 ff716af99a07369a61dc5c9fdaf1e34ff627cf99
SHA512 d2f3972a31dda85fbde1b54a370e927ca58441bd3b54292e0512babb5004c743791b3a4a36f45f4698fc1284441fc30dcda6519a216ea54335fb998071003052
SSDEEP 3145728:nIMyHNnEWVn66ZzhSbhdp/Z4wdQ0sEhmZy4NO7kHGUJTfQYYs:I3HNnEWVzZzcF9Pd1h+Yk9dQYYs
TLSH
T159683345287E6EC0E795EA3B8B106050F15FDA500325A843D8ADF7A8C67E6C5CFC399E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  InnerEvilLauncher.exe
- Size 137.3MB
- SHA256 6fbdbc70909c697fd84b476c2aac38ec39fc64278e65d463d2103e0da1bdbf5a
- MD5 8f2e887ee8d7216a67665bdd84dc1225
- SHA1 fbae5325dfcdaa525828d89ad0b5af8d3df00f04
- SHA512 db9d994bb71180ee69bf1f80d4f979625903802ecdc6ba6cddd7c85e92411c2c07d95337b1e0d5ecd882df844cf0c928b1b0539fa04b8dca49338785505bb27a
- SSDEEP 3145728:DKtxWqJsZYqMB9r59bfsd4V0aj2tNV22YBdmltIfo8tzuG6SY7:OvWqJsZYB9rvb7LY32piIZ8G6SM
- TLSH
  T1C1683341297E6EC0E791EA3B8B006090F15FDA500365A847D8ADF7A8C67E6C5CFC399D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral1
- Target
  InnerEvilLauncher.exe
- Size 215.1MB
- SHA256 84424b36d1a68592ef85588e15d1153074a1cf1849a75fbf60bb0039d2b2ebc0
- MD5 377bf9b02e21a52fe910ecfc3f692cb5
- SHA1 b108bd4e3c76fb5131543315fdca15c8331d0cca
- SHA512 8aa1776b25be486af458ab7d1a090c527ab4ecaf7f9856764678262836e939ab21d220903a8e6f604d82d079db741aa55bc52e187888537ea52c8b9680fd1374
- SSDEEP 1572864:lOa3GJV1iPuKYncvg3LOL9Yez2OTe1lKrnzGjxuJm0p6TQLCfTQFHk4KmntuykGe:MximKYn2KwgF8V8
- TLSH
  T16EB88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447522F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral2