94f53af10445f53ed3a9a127a5754aa60f2e0b1a0b0bfb282f0933a8a0d01ae5

General

Target
7f3cad16607a87b13dcc24115b9907de.exe
Size 242KB
Sample260820-g5rals1dpc
SHA256 94f53af10445f53ed3a9a127a5754aa60f2e0b1a0b0bfb282f0933a8a0d01ae5
MD5 7f3cad16607a87b13dcc24115b9907de
SHA1 6ef4829615879d4c6dbd8b7da05799c7bc391171
SHA512 0f2e8916b651cf17b6a30195d0140ae8a8567cd99ad1e1c580a2b1c755e508aa506d8b63be7611d78e3a2d748ab5dcb6633ca6031ac01d6383354da612dd1767
SSDEEP 6144:r380dV3DdTex8NLVNwymqwPhhHFAx5bSI:r73pTecxNwymqwP6+I
TLSH
T19B343A1B7FC9DB15D9A53A7BC7FF09004772B5E20132A3052B499AF15E852273E1A2BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  7f3cad16607a87b13dcc24115b9907de.exe
- Size 242KB
- SHA256 94f53af10445f53ed3a9a127a5754aa60f2e0b1a0b0bfb282f0933a8a0d01ae5
- MD5 7f3cad16607a87b13dcc24115b9907de
- SHA1 6ef4829615879d4c6dbd8b7da05799c7bc391171
- SHA512 0f2e8916b651cf17b6a30195d0140ae8a8567cd99ad1e1c580a2b1c755e508aa506d8b63be7611d78e3a2d748ab5dcb6633ca6031ac01d6383354da612dd1767
- SSDEEP 6144:r380dV3DdTex8NLVNwymqwPhhHFAx5bSI:r73pTecxNwymqwP6+I
- TLSH
  T19B343A1B7FC9DB15D9A53A7BC7FF09004772B5E20132A3052B499AF15E852273E1A2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection discovery execution persistence privilege_escalation spyware stealer
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2