229ec7ac64ebf4f8c1286d87ac02baa46ee355b148d028ecb2a099ae3f8eec95

General

Target
2026-08-17_d7a13719ce9e250ba4b7f41e690e1482_hive
Size 3.5MB
Sample260817-3vjcxaec75
SHA256 229ec7ac64ebf4f8c1286d87ac02baa46ee355b148d028ecb2a099ae3f8eec95
MD5 d7a13719ce9e250ba4b7f41e690e1482
SHA1 eeef253c4b207435e2be288cf2f9ed9fbb6ecb18
SHA512 4cd3862cae37959fc131b8fe5b1c992105050885066fc022d48d4fd5972e05468ccea3ac388e1d860013522c7f223000402fd1aad786ea5d9048da309a0135f9
SSDEEP 98304:4g4wTeCUxQiWGF8U135QuRfjkTVK4WzmmE1WhOUL+:LHTeZOi/FF9uVZmTs
TLSH
T1E2F5330BE3BADB51F89E73376446CA51F35AA7E20FC6E39E18C52E1D529AB00B45013D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_d7a13719ce9e250ba4b7f41e690e1482_hive
- Size 3.5MB
- SHA256 229ec7ac64ebf4f8c1286d87ac02baa46ee355b148d028ecb2a099ae3f8eec95
- MD5 d7a13719ce9e250ba4b7f41e690e1482
- SHA1 eeef253c4b207435e2be288cf2f9ed9fbb6ecb18
- SHA512 4cd3862cae37959fc131b8fe5b1c992105050885066fc022d48d4fd5972e05468ccea3ac388e1d860013522c7f223000402fd1aad786ea5d9048da309a0135f9
- SSDEEP 98304:4g4wTeCUxQiWGF8U135QuRfjkTVK4WzmmE1WhOUL+:LHTeZOi/FF9uVZmTs
- TLSH
  T1E2F5330BE3BADB51F89E73376446CA51F35AA7E20FC6E39E18C52E1D529AB00B45013D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer upx
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2