133362c0eeeed036fd8ae9e9a51d553c576ed7502118018caa2581d8d50eb428

General

Target
NewLauncher-2.0.9-windows-x64(3).exe
Size 101.5MB
Sample260815-ypdg9asgnb
SHA256 133362c0eeeed036fd8ae9e9a51d553c576ed7502118018caa2581d8d50eb428
MD5 1383affaf2930fde9e7cc334f19915de
SHA1 7b9eaf49be1b4d6538f5cac638c926595e7b404b
SHA512 91f5d2fe5ca81ee50a966e91ff6fd5a45e32b0281f5f8081bdfa1fc05420a3f29c17a76446d4e928ed3f2253643b5e2f9f85f7360a369deff06d85c75182a958
SSDEEP 1572864:cioXDcXlP3kl1AAdth1BkVrTGWENSIjYKDc4ihI8dC7z06NWHFQ6ouv4:cijyHACFyGDPcKRihNQ8kuv
TLSH
T1A23833F0C1A52C1B3658B7B36F3E8851F1E917EF2D06C32E562857B8E1940CB47AA467
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  NewLauncher-2.0.9-windows-x64(3).exe
- Size 101.5MB
- SHA256 133362c0eeeed036fd8ae9e9a51d553c576ed7502118018caa2581d8d50eb428
- MD5 1383affaf2930fde9e7cc334f19915de
- SHA1 7b9eaf49be1b4d6538f5cac638c926595e7b404b
- SHA512 91f5d2fe5ca81ee50a966e91ff6fd5a45e32b0281f5f8081bdfa1fc05420a3f29c17a76446d4e928ed3f2253643b5e2f9f85f7360a369deff06d85c75182a958
- SSDEEP 1572864:cioXDcXlP3kl1AAdth1BkVrTGWENSIjYKDc4ihI8dC7z06NWHFQ6ouv4:cijyHACFyGDPcKRihNQ8kuv
- TLSH
  T1A23833F0C1A52C1B3658B7B36F3E8851F1E917EF2D06C32E562857B8E1940CB47AA467
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

costura discovery execution packer persistence privilege_escalation defense_evasion spyware stealer upx
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2