30baa782e15bd58f7e4e2ca735092b08fba8b08e6ed9e37bfa9a321d791659ce

Sharing

Copy URL Twitter E-mail

General

Target
ato15.zip
Size 15.9MB
Sample260820-plqtqsck3x
SHA256 30baa782e15bd58f7e4e2ca735092b08fba8b08e6ed9e37bfa9a321d791659ce
MD5 f637c440ca8aec9e18ef32a551f5230e
SHA1 b4d311cda352055ff08cf5659347487bdce88fa5
SHA512 3665894de2f9825fa12c3fe4dae8b2970dafbed9a52dab7bebb1256234a35efb4b976fceb4093fdd11d5e776da77e58dbd68a0c5905e0bf2730e6b11cc42e830
SSDEEP 393216:GR5xnpWZgAAZxF9CShpaGwHb2mXO8JyBBqK2ljurVOg+CA:enpTHZr9NpC7fXYBexiOg+CA
TLSH
T152F633448930983429B5D359078C0F7D6237846D90AE70E570E32BB7F28B3ED6979BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BWGdubl215_protected.exe
- Size 10.5MB
- SHA256 3b62e4a47335b120c04e2fc1845adf0e13f1d80d7bd09ab15fe2db6f1f6d2cdb
- MD5 b15aa4d702cf05f7ff331652bdb4815b
- SHA1 55e86d78714aa850c3304d3902e1674a9972fb00
- SHA512 945d1f200d955e9ccc1a438ec9115e167a0c5cb129c7ad479363f905b533b40fa163852de29523a2a16c3b035f51788c4dae71e6f5d21af9333d6110c162e30c
- SSDEEP 98304:/7SCSMk6SuAyL9U04rEX+gVmThzaeUo44FEtGUqW3ca6VK9GviMBix2VnpvsGdLQ:/mN6ZAy60mtThz3PnNKfAbfRb4
- TLSH
  T15CB69D07ECA155E8C0AAE2358A639153BB717C484F3223D32B90F7292F76BD0AD79754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  Clpdubl213_protected.exe
- Size 2.9MB
- SHA256 8f9d89b0225b1e8995029a8102446cc485be0cf2e339b6cf6457aa0309816824
- MD5 e0887fa5acbb756b153a9d615c8de692
- SHA1 da53473dbbd2626bdccd2efddc9669b1ff957787
- SHA512 cbcb976103a230f8414c862baeb05e464f9c25505876038d6433c8684b58755913b36bdb09a17dde47282878658906910110a45ea1491ffbf0f36d32c6b67c82
- SSDEEP 49152:S4nWGkHz3tlTDCAm2IwACnvhq7NEsKYbNOG8Q/xGWQIU6iY:sHPJvMxGm+Y
- TLSH
  T16CD58D03FA9685E9C09EC07883569233EB36B88D0A2077FB27E457213E66F905F5D749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  aclnt54_protected.exe
- Size 8.5MB
- SHA256 3aa47a6402c1087b5a52af8a285ebe653c7acdad83f6b7af607907de04e2fca1
- MD5 aefcc48d8fa5ff0442670511a92196a0
- SHA1 d47ea0e528df06d92efc4c650b0343f16934f759
- SHA512 90298b942f665ae3f1e003fe9fe664734feadea5f6caf0b09f2cb3232f82f11c5e26ad4b580eda8bc8d7b82d0656b3307fb033f11316d871816210cd3de485aa
- SSDEEP 98304:yhG6J7rwXAFGrYGhRCntAxjJPnkxneRw/Z+e8K7cF7fle:NIGRwAxoKqHZI7
- TLSH
  T1A1964A22BA5698ECC15AC47483468A725A3134CB0B35B9FF40D496793F6AEF05F3C768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution persistence
behavioral5 behavioral6
- Target
  bStldubl215_protected.exe
- Size 10.4MB
- SHA256 ea48d4d4e15af89a5f64efcbd199fbd68b9c79c51f95c540bb354e7637f9f83d
- MD5 20fa8f66fbca11d4c1b6e06943f247bc
- SHA1 71f15fe1810fcafdb20337f9b6e1aec31ff18630
- SHA512 624b988b58b26b460db5a5810ebbef57f7e8e544abfd60a89fd2bcf69612af978ad5519f31d0c6f7dc263b1028c01af950dc2a28e70c9d51294c10f275a3caa6
- SSDEEP 98304:Bn2/QNMyTGLNRPa/+yhES1y5558mZedFpEE:B28MkGLbP9558YeN9
- TLSH
  T1DEB63947ECB542E5C0AED176C6669253BA713C884F3063D72B60B7242F76BD0AEB9740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access defense_evasion discovery execution spyware stealer
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral7 behavioral8