00d1f967b243d74f40d863a0a5ea98c637cb4b99f0598eaa533f1070f777c122

General

Target
test.exe
Size 363.7MB
Sample260818-aeqstsscrb
SHA256 00d1f967b243d74f40d863a0a5ea98c637cb4b99f0598eaa533f1070f777c122
MD5 bf22bf96713653b5077dc51cc8f9ad69
SHA1 7871b00b27761cb459ea7f3ede396260f92505ef
SHA512 809dd16a641019271a3f084f9d426375afb2388a1e33b594f64b7c2ef847ca6b76b929887a9adc22e7090c040ea2ad881122b19154a0a11d30a8514389877606
SSDEEP 6291456:c9jrEnQqGF2CLa7xsLnWXPRXNY+DNQCYbBegBWL+gaqdlQUMO95YZrkLHKl09G:cR0HGFTa7CWXNNQCyBJBI+gaqdlQbVkH
TLSH
T12509337056205E1BF1C8BE3BEAC6D734A25AC906772250CB2B507577294F84E8FB2F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  test.exe
- Size 363.7MB
- SHA256 00d1f967b243d74f40d863a0a5ea98c637cb4b99f0598eaa533f1070f777c122
- MD5 bf22bf96713653b5077dc51cc8f9ad69
- SHA1 7871b00b27761cb459ea7f3ede396260f92505ef
- SHA512 809dd16a641019271a3f084f9d426375afb2388a1e33b594f64b7c2ef847ca6b76b929887a9adc22e7090c040ea2ad881122b19154a0a11d30a8514389877606
- SSDEEP 6291456:c9jrEnQqGF2CLa7xsLnWXPRXNY+DNQCYbBegBWL+gaqdlQUMO95YZrkLHKl09G:cR0HGFTa7CWXNNQCyBJBI+gaqdlQbVkH
- TLSH
  T12509337056205E1BF1C8BE3BEAC6D734A25AC906772250CB2B507577294F84E8FB2F25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  payload_built.pyc
- Size 192KB
- SHA256 ac82560b3e27c751d3992f47ffd77354951fd8b0447ac1e06670d8b8835ff9e8
- MD5 2eca3354b9959529a824044e36890416
- SHA1 7799904ef452ecb822115262563142c508c02b59
- SHA512 b4be6eefabde8e5d742954517b922290cbe1be1dea3f8000e02316703f37ff4ea121bf012e0ec2ab629064d6a45b0283940df64481120346dbea897ef49f3c4e
- SSDEEP 3072:crO2VVpghatIcgoxEAdooJfqGAqokDJShBXhTYNHE+w+4pq:cwst+3AdooJfqGOkDJShphIHg+v
- TLSH
  T11514E742BA21C67BF855F376C416110BF36984F2B350DB67365BD0AAAF89B643C604EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4