Extracted

• • Target
    FuntimeCheker.exe
  • Size 66.9MB
  • SHA256 f7abca95dd1c5a3267ea4bfe14e8905438ec128f6d1dd56571bf37a43940c796
  • MD5 91b2ccd17f2dbba616c3a3b3f2af986a
  • SHA1 8fdcafaa2ab63832194fc92a80c12c5dcd5715dd
  • SHA512 6a20dd9a5d6ea308d0ebec53f0052a2b3c7a281c476e7e4389677ef76375704a1ce5b5b04bd63cd0489af3ee897f7417dd8bc89ef6007dbb223deb51dcea14dd
  • SSDEEP 196608:hvH2trS8jjiln+FODvH2trS8jjiln+FOM:VHMjelnI0HMjelnI1
  • TLSH
    T17BF7F111AAE402A8E2B7C374DA7B5945E77778460730A9DF0394955F0F33A948E3EB32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsalatstealerstealerupx

  • Detect SalatStealer payload

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1