1685d3bc76c4939efe368bcee2d0e8c9a7870c23d1c9342457fdc5d3f6f25441

General

Target
mscopiIot.exe
Size 4.3MB
Sample260822-2hk6asvwas
SHA256 1685d3bc76c4939efe368bcee2d0e8c9a7870c23d1c9342457fdc5d3f6f25441
MD5 5af589e4f593d62ba0c886828898502e
SHA1 bb6fc64dc4ff263d4287ccfba6b0702dfeb083c2
SHA512 8f4d6d379da73c824f39b393805e33953a06940dfdec0245671d47180cefa215a3c03a04516d90487611af858bfc697d5f83b61322c2d9a5fc1754a0aa463da4
SSDEEP 98304:KoL7vudyK1cbyVQPxgdjNBF8QjwTj02EzWD9MbKj6iLP6A:VLL8cbyV/djNEQjF86Kjn+
TLSH
T1AB26332A790738D2F18CF13BBB36F524391D0EB765A12497150552BE0FBB2D2FE96224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mscopiIot.exe
- Size 4.3MB
- SHA256 1685d3bc76c4939efe368bcee2d0e8c9a7870c23d1c9342457fdc5d3f6f25441
- MD5 5af589e4f593d62ba0c886828898502e
- SHA1 bb6fc64dc4ff263d4287ccfba6b0702dfeb083c2
- SHA512 8f4d6d379da73c824f39b393805e33953a06940dfdec0245671d47180cefa215a3c03a04516d90487611af858bfc697d5f83b61322c2d9a5fc1754a0aa463da4
- SSDEEP 98304:KoL7vudyK1cbyVQPxgdjNBF8QjwTj02EzWD9MbKj6iLP6A:VLL8cbyV/djNEQjF86Kjn+
- TLSH
  T1AB26332A790738D2F18CF13BBB36F524391D0EB765A12497150552BE0FBB2D2FE96224
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery execution persistence spyware stealer upx adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2