fe29f572a6deebdb9cd114273f5124eec50a329c724d3adc6255d78eaeb9a4b7

General

Target
2026-08-16_d24d1c04b2d2ed96d3f7f1be1c2de407_hive
Size 3.3MB
Sample260816-t93wessclc
SHA256 fe29f572a6deebdb9cd114273f5124eec50a329c724d3adc6255d78eaeb9a4b7
MD5 d24d1c04b2d2ed96d3f7f1be1c2de407
SHA1 a308f014f6b5ca51ee153feb3f22d9bc76aa1e83
SHA512 02fa191bfa3ba9b6ff2a8322b7715d58fc2785f97305a1a7b3191c2453d89e518167bf677cda854049471a10aafb62d2a50f97772cebdab93654ee813073204b
SSDEEP 98304:gBRWcTgpFUUc+PP5MX+n5DveJmjNEizRjhtg:gC2gUB+PhM81veJGNES+
TLSH
T1ECF533277479F632C7A1F770619FE9153776B121076C02CAAD8A1B81BBE08BAC97D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_d24d1c04b2d2ed96d3f7f1be1c2de407_hive
- Size 3.3MB
- SHA256 fe29f572a6deebdb9cd114273f5124eec50a329c724d3adc6255d78eaeb9a4b7
- MD5 d24d1c04b2d2ed96d3f7f1be1c2de407
- SHA1 a308f014f6b5ca51ee153feb3f22d9bc76aa1e83
- SHA512 02fa191bfa3ba9b6ff2a8322b7715d58fc2785f97305a1a7b3191c2453d89e518167bf677cda854049471a10aafb62d2a50f97772cebdab93654ee813073204b
- SSDEEP 98304:gBRWcTgpFUUc+PP5MX+n5DveJmjNEizRjhtg:gC2gUB+PhM81veJGNES+
- TLSH
  T1ECF533277479F632C7A1F770619FE9153776B121076C02CAAD8A1B81BBE08BAC97D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer upx
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2