05d76e9e9e80600df9c01889cfbfcf7eabee717588f52a5398d5332f64d4d3e4

General

Target
2026-08-17_34b8e5bfed46bfca578bdc4ed52b133c_hive
Size 3.5MB
Sample260817-2f212a1cqf
SHA256 05d76e9e9e80600df9c01889cfbfcf7eabee717588f52a5398d5332f64d4d3e4
MD5 34b8e5bfed46bfca578bdc4ed52b133c
SHA1 97c1e703ae541aa9c8b7ee849bb38690fb5e8670
SHA512 fa040d0a22cb82c35db98e93d593c490218fd461bb8d026d731edd6ec72cc14f06091e4d61b2376401dcd35858e8223c68a75d49dc9fad912872095f3997dbdf
SSDEEP 98304:sanJGvNDgNOQhUA13QubFLcRxt15QWnieD5:/nWMNvBQqLcR31m5eD5
TLSH
T134F533819C48B8CCC9AA67B1E5CCEB164428F459765B25C6E5C36ECCAEC3C4EC0BDC56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_34b8e5bfed46bfca578bdc4ed52b133c_hive
- Size 3.5MB
- SHA256 05d76e9e9e80600df9c01889cfbfcf7eabee717588f52a5398d5332f64d4d3e4
- MD5 34b8e5bfed46bfca578bdc4ed52b133c
- SHA1 97c1e703ae541aa9c8b7ee849bb38690fb5e8670
- SHA512 fa040d0a22cb82c35db98e93d593c490218fd461bb8d026d731edd6ec72cc14f06091e4d61b2376401dcd35858e8223c68a75d49dc9fad912872095f3997dbdf
- SSDEEP 98304:sanJGvNDgNOQhUA13QubFLcRxt15QWnieD5:/nWMNvBQqLcR31m5eD5
- TLSH
  T134F533819C48B8CCC9AA67B1E5CCEB164428F459765B25C6E5C36ECCAEC3C4EC0BDC56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer upx
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2