76f384706ee01b3984196a44b9b322cc1dc3e14aa69049d89439e02ea2bfe6d4

General

Target
2026-08-17_409e9addfa1f6896c541c05aca43e298_hive
Size 3.4MB
Sample260818-avarjsef22
SHA256 76f384706ee01b3984196a44b9b322cc1dc3e14aa69049d89439e02ea2bfe6d4
MD5 409e9addfa1f6896c541c05aca43e298
SHA1 34877a84107ba052b19385e5ba215c36980af81d
SHA512 369bfadd23ae5e5f2f78f2efb68d75c05acaa5689a32cb0157126d16382ca2a61ecba919bcfa64fa3337cbe1b206e1cd2f59763964260e19f3fdd12f0cf554c1
SSDEEP 98304:kThgh1twB8Yx0XRz3CKZISj2PVZAsH6CSl+oyKX:0gfidxKRz3CKZISj2XiCT9K
TLSH
T160F533346F87F426E7404639A3C68BD7CE3F1348934C5601DAADE9B362565B9B2E8D80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_409e9addfa1f6896c541c05aca43e298_hive
- Size 3.4MB
- SHA256 76f384706ee01b3984196a44b9b322cc1dc3e14aa69049d89439e02ea2bfe6d4
- MD5 409e9addfa1f6896c541c05aca43e298
- SHA1 34877a84107ba052b19385e5ba215c36980af81d
- SHA512 369bfadd23ae5e5f2f78f2efb68d75c05acaa5689a32cb0157126d16382ca2a61ecba919bcfa64fa3337cbe1b206e1cd2f59763964260e19f3fdd12f0cf554c1
- SSDEEP 98304:kThgh1twB8Yx0XRz3CKZISj2PVZAsH6CSl+oyKX:0gfidxKRz3CKZISj2XiCT9K
- TLSH
  T160F533346F87F426E7404639A3C68BD7CE3F1348934C5601DAADE9B362565B9B2E8D80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer upx
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Looks for VirtualBox drivers on disk
  defense_evasion
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2