e5cee4e4cbb8fa1d729dffb7e844bc86daf5361ac607696757be34b74e0e29a9

General

Target
2026-08-17_ca0dd2535abb64372028b4b0c856578a_hive
Size 3.3MB
Sample260817-ptdjdabm8v
SHA256 e5cee4e4cbb8fa1d729dffb7e844bc86daf5361ac607696757be34b74e0e29a9
MD5 ca0dd2535abb64372028b4b0c856578a
SHA1 ba3b84fd93df0abc33a82e8b313f6068f35c76cb
SHA512 4f5587796e154d84e998607f5e2daf234574ed51a7e7fc796aa4fefd41db080085a9de36b2abc027c689c780c352a99fc29834fc65548a2e9c456e3e87c0e51e
SSDEEP 98304:IBobFzOKcPDFAG5wk/mqMHQRmDi1LVCPelW7S:yGvIFAG5dm/w8+seI
TLSH
T1CEF533D70D0A84BECF51507BE6805039FBF9AFD61CAED06A701335ADC4E5D3623A26A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_ca0dd2535abb64372028b4b0c856578a_hive
- Size 3.3MB
- SHA256 e5cee4e4cbb8fa1d729dffb7e844bc86daf5361ac607696757be34b74e0e29a9
- MD5 ca0dd2535abb64372028b4b0c856578a
- SHA1 ba3b84fd93df0abc33a82e8b313f6068f35c76cb
- SHA512 4f5587796e154d84e998607f5e2daf234574ed51a7e7fc796aa4fefd41db080085a9de36b2abc027c689c780c352a99fc29834fc65548a2e9c456e3e87c0e51e
- SSDEEP 98304:IBobFzOKcPDFAG5wk/mqMHQRmDi1LVCPelW7S:yGvIFAG5dm/w8+seI
- TLSH
  T1CEF533D70D0A84BECF51507BE6805039FBF9AFD61CAED06A701335ADC4E5D3623A26A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer upx
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2