a9963ee1b4850b1626fbfba8105ebd43bdef693765b125baa3b3bc0f7ebfd995

Sharing

Copy URL Twitter E-mail

General

Target
FLPro.rar
Size 100.0MB
Sample260823-2e13cabk71
SHA256 a9963ee1b4850b1626fbfba8105ebd43bdef693765b125baa3b3bc0f7ebfd995
MD5 69caca9c998ef6c7f6c4c986654842a5
SHA1 12f70b1cdbbdf655caaa17df43c07513c57aea82
SHA512 dfefd35e44692b54797aa3a73d76063b491407564c2de8155a986a6223304e61237a50aad1a36d34984807c393e7cb24455320959fedfe640fffb729df7340e5
SSDEEP 3145728:Sj3jwizEVWX+0d1XpuGit7CQUszYv9ZIqFvfqByM:y3sizE4XD2t7C9LJHqUM
TLSH
T1F038338E1D0AF598AD579416D7D3F48A68CBF1E6E7840B8B156209AC463EB4F5FEC003
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Pro/FL Studio Pro.exe
- Size 683KB
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH
  T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Pro/learning_tools.dll
- Size 1.2MB
- SHA256 c4b3c8846438fc2461dc8603d1e47e3871c8e5fef4a30a8b1894d485a8715c9c
- MD5 eb043f6a58ba277f85cd08a0ec26aa32
- SHA1 600f9753bd9bf8c5c45df21c73372aa0a6dc5385
- SHA512 f34915d2c71d846b5805693d5fa6120b958cd39865dc1c3ba865e7ad0292cdd8e6cbbd1df0cfe95b7aebead6c62d6c99b3471a60265f7c71dce5b6501d03b574
- SSDEEP 12288:WA6pUB7ugVy9gb9DvE9GeEJNklh3YgkLcIzOcaQoVgkLcIKcaQbgkLcIZcaQMsnI:WA6pUBMQFeEJNklh3pvsnv/CHgXxpgn7
- TLSH
  T10C555B2172066837D99E81B5E8735283F3707882251744FEB21CDDDF2A6EBC521BAB35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Pro/libEGL.dll
- Size 499KB
- SHA256 6397808c0745f08bc971dcf1eda61deb164d9c372dc6d5dd2fe8eccbdb7fc341
- MD5 2623d37b55bf9369f42d2a5a70ee51b4
- SHA1 78898fb21c20e085c34dfff9822fb05e9831fc77
- SHA512 ed75b7a6845175cd32a5e4fd6e091b41d6eb4f68139ea37d7a4207919d10e722d9508a512be6581114ad28e6411ec9ad1a35818e41aae05baba0e29277f11260
- SSDEEP 6144:ngfx9w55AkgG95e1xnaEjbiKaU3kQaJjkcWcfRYCx9/pt/BCSKxJIUgq9WXA:n15z5kbiokQaVkcWcfuCpCSKxuA
- TLSH
  T1A7B48E16B3D849A9E07AC038CA438547DA7178460B75F6DF02D0E27A2F77BE46A3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Pro/libGLESv2.dll
- Size 6.8MB
- SHA256 dca8d78efd1cc0823c3b044ddc8043035e2e21467705e140a6409d732eb23670
- MD5 155b895c53f0a3aa401f9e4850636fc1
- SHA1 316bb486a4b2eda476e5e9e3eb29814bc115d69d
- SHA512 61c90a3d045895cbc9395b541dc247c312a8338a802b68eb1426aef3572639f0849d4d05459529b900d40445eb3b345564f4a952c15874a9d92ce3c84d339361
- SSDEEP 98304:Z/4bGKn5Ot8E8LQIpKeZJD4ZoLS1ckAC/67:FluPZUWS/i7
- TLSH
  T162667C03F29681C9C01DD274976B8623F635BC850728B6DF269457212FBAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Pro/mchrome_elf.dll
- Size 2.3MB
- SHA256 db580e37cabd8a804e48ae9035383c6b7e3e9ddbc8d05abee242fd3c3ec7c8dc
- MD5 a141ce49faee3e4402ec7b22b2739bcf
- SHA1 42e56ef060a438591bb2642ff05b519bb2eb4b2c
- SHA512 81219091d8b95d7a8133e8434395b3770a9835e4fd82c234af2c346deaf3e9e570908390a0250e76c08cb898fe953b62cb9d5eafc5bcf9c587f74c1b86fe0279
- SSDEEP 49152:6aI8PLKkBrx52j5gjCOQ8fFp6nDIFazNBlPAHR:6aI8DF50g6MMDleR
- TLSH
  T1F6B57C13F2D901E8C05DC1798B5B9632EA61BC460B35B6DF0AA076161F7AFE4673E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Pro/mconcrt140.dll
- Size 324KB
- SHA256 5344e1f74334cce06b8cd14a901e27d29a1708c786fb7ad3281a00044205a051
- MD5 ae936484d159ba103c3b9b4a3c9d8d19
- SHA1 db719198108130aa109964ea6cd544f912735a53
- SHA512 d108b816f85c758b5dda1a22e761f607428e4a0e54f46a9e33b6fdd67c27dd4151a75091510eb8091924ed703dcba26db2f6bb5c74b5fd58e104ed42d8e05637
- SSDEEP 6144:lpxc5oSb/fSpwaxspxI6CLwaVInWzgFYxNxKYSF:lPc5oSDfStI7qz3lPE
- TLSH
  T16C643A8A76580CE6EA67D039C693C50BE6F3B9452352C3CB1364938E5F677D0D83A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Pro/mdual_engine_adapter_x64.dll
- Size 5.1MB
- SHA256 d5ec2ca6c7c116f57f45b3a80a99664b68f02be305d8d41427f4af877421011f
- MD5 28a22c699f09dba495f45c6ad3f2ed82
- SHA1 461337b7cba23c02a856e426abac1b7c6b9d3691
- SHA512 964dab1d13df07b4f0e69517779d5ed71f682e72651e2b6fec268ddf9fcf2cc02e18d6cd2d003d442191821338f0797114632e28a7c90871b513aef1b9079af6
- SSDEEP 49152:9IrYTlptJDw/NIbupGgQ4HZBlubdkD3TvvOuXuGv2MfvfkMNODsgXmcCxOJm4wwL:5rIl8cFNF7Rknrz64Z
- TLSH
  T1BD365B53F29611B9C00ED9B88B2F5632A5647C4A4B31A3EF0AE936210F75BD85F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Pro/meventlog_provider.dll
- Size 15KB
- SHA256 ab44220f0647d6d1a5df27d11be725a937b1a096b620638bacef5ad01db50646
- MD5 f1713aa15b05fa70bc45d6eb186e651f
- SHA1 663163f56f6829b2884cb109c68aa566914e5770
- SHA512 4e70ef67f7b3492e7dc842b3486ce2ecf845f135426a2fb94514b74ad083b4fc60142dca7e2a3afab0a3a4b9dea3fd7fc9f4d6682e8520139963296c73f825e4
- SSDEEP 192:1qqnWd0LVWc6Wz2DWHbNpofeBWseaAWzQcNpcspKLX01k9z3AbJ98Jt:NWd0LVWcr2y4GlNSscmeR9z+Jy
- TLSH
  T1187229D697A88502FD9AAEB052B8CD533D3CB7C21B1096DB1682F0581C627C4FF3066E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Pro/microsoft_shell_integration.dll
- Size 449KB
- SHA256 d1fc28030b6e9974cfd71a3bd6fab0d5e3f31b375573f0d10ff957ac4146ef00
- MD5 775a61324343c32907ca4fcc3b980e19
- SHA1 573b39ad61639257448a1e4908c5ab1f3d0ecd0f
- SHA512 793b20a0e450760aae0a740d49695552846597a1e4ff5f733aa20e1bd686c439471da069f58ac3fb2b3f677a5ef0fb75730e9cee4538d264b773690465b6f992
- SSDEEP 6144:unFPvNtCHUcKTmUAh9dPQ0w7lWYHE35zmxIlD40RLtMFN:unFPvXOKiVY7lWYHE3RmxIlD/+N
- TLSH
  T151A48C05B7E448A9E076C138CA538546EB717C960B71E2DF03A0E2692F77BE45B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Pro/mip_core.dll
- Size 5.2MB
- SHA256 b91132b09bccc01df0d0a168691bb9e3720d7a5c0f69f1fd838ea6f87cceab0d
- MD5 0622b767e9e89eb0edba095d3219d660
- SHA1 6af7744dfa8af85bc2d54954f1586e968dd2a3ec
- SHA512 2e0562acfd3faf7e102cc1380df05efba88fe29f95333cbaf1cca44b44a4070ea0bd056ec6ab7ece86b921a35ce5b50708c68a3a9f427ec35349d9c0e412591c
- SSDEEP 49152:DuBYH146Mvl8bR+WM7ZvaL4Zrzi8n8sJsRrlurPuTtuGKc7mhT5Ci6uBtiLVja3c:/14lLfzhuTJytXiYjGPwaWu
- TLSH
  T12D467C57B7A800ACD4BBD27D8A4B8507E7B2B806573197DF02A0577A1F67BE15A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Pro/mip_protection_sdk.dll
- Size 2.4MB
- SHA256 3e46c961339de0359adc33e27aeaba932fb609304bc764aa0fa49b7d11dcfd78
- MD5 17ac1c062c43f00b3ebe5bb15f866a5e
- SHA1 9f8f3001e81b4d64a1833e071782f22caf44d7ba
- SHA512 6a57422a0f6e0cfdc18b1a57b3153d4b2179c8a79125e9547ffe7158356dbd580bd664d0336a3e33a95d39343b0216b49a794c8506670109876e58bce750b51b
- SSDEEP 49152:OxFDqq8uX+lXcW9vDbslAbjE/rHnULSv+F6i8a3isHp:r1Wmp
- TLSH
  T182C53C477A554099C1EBD2B99B1BC943F234744A0334BAEF039097572EDBBA0AFB9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Pro/mpclient.dll
- Size 4.5MB
- SHA256 e9bfc9e31e6b74b3873bbf25336b8d1138ca4b2c467bd7549488fba3ac9e5f38
- MD5 e5b2747424ee3437375ef6f4975934e0
- SHA1 7de60253fd0bb00fb9be275857753dc05cd0566f
- SHA512 436bad59b5db827788069b07c2cfe77fcacdd73788caddcf92cdd833c67dc4d777cc440edf2aeb01d0fafab79193a77fa35717dde7f2e4f689cf11daf7b745c4
- SSDEEP 49152:1t28vxXG1G13mZl6EMUc/G2x37ccl5BOPw7GukvqnRRoD0XhHxg:mBo3HxLcI5B9XXxg
- TLSH
  T1F9269E03ACA09664E459677F80B79212B735B858C73AB3E71E60EB702F213D26E75F11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15 behavioral16
- Target
  Pro/msedge_elf.dll
- Size 4.6MB
- SHA256 20150099f08f29714d52137f6d2b9e9799bc031c4f7228912772643d2e634bc3
- MD5 ea68c6ee94337a94f8a3d461f1d67917
- SHA1 5e058eeb6f47f8a0053ca453db506482ea590021
- SHA512 b54651c5d58b7bda94d89ca328bc4f9130ef5ebcb04cea721cbf4a32d3c24eb7173a3ad3dbbec5695a8ad3b5ae7471456681d03941bf0155bac35dbd09863722
- SSDEEP 49152:3FG9S61PDnfxmn2i6TYTcNVoWc5mpJ9QTj2rTGCVOxZzZwY9mJWuoowUzdtYgdZv:Turyf9iTAPEnwc39tRVye
- TLSH
  T1AD264A43F25211B9C44EC8B4CF2E552297643C8A4BF193FF25E83AE11A75AC97739B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Pro/msedge_wer.dll
- Size 115KB
- SHA256 6d5ccc1720656ece210fb98641a4002409d0b9900d3cd9fec911b526a97aac43
- MD5 be1d7da17218e3d786bb45fe8453b85c
- SHA1 a767dbbbdd063c7122d50e93e0a769489d48b0c4
- SHA512 cd6f0fd0e45e0025446ad5736a6486f7a0cbc8a3caf1102e376979256ed3a377d2a5e74fa32824c7df38171ffa1cb3742076de053b12f1569245a7e1776f84c0
- SSDEEP 3072:k7RSOBa1Trm0O31k0IeYIycAtpFrpqpqpvIwT2UczzYafHPBA:iRSAsv4k0IeY3hIfYh
- TLSH
  T1B8C36A5763B900BBE177863885634E45EB76F8118720ABEF03A0425A1F637D19E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Pro/mspdf.dll
- Size 18.4MB
- SHA256 52c9c7b146d5d747e113b4b35cb4c703162f2d985ea242ec4291db54f7377bf5
- MD5 b0785c4d57214a791643ba9d59549cf8
- SHA1 35fa9f69941fce1d1a29aee164bc956f82b87aaf
- SHA512 bd568668ea2b5ed5a93504de2091ad845d4a27c28deb330752d9392d30d149b313a6f59cc133d0777483099b71300ad11916da8514dd8081decbdc09e7855961
- SSDEEP 98304:yK20/CdTySbSI8/tkyTQQv/45Ok16RMBQjhWOvPy/UO0JV6xEnwjql1UntpC4X0I:yOTTQQv/45OkMK/7Y6x9bX
- TLSH
  T1C6176D06BB9A49EDC04CC874934B86535E20B8CB0B75E5EF45C962192F7ABF85F3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Pro/msvcp140.dll
- Size 550KB
- SHA256 f23ec08cd51a0377de3d5e15265f28696e3602270df6f9057ace13a26d9a48bc
- MD5 ce4433a1b66d6e3f123d4853ab31b79d
- SHA1 1c5d64e4f7147928835e7b3260d81cf448a651a0
- SHA512 5d933333a69ae1f12ab1aeab822caf5f975a685464d782f8b582b92e84a331ccc80258dd3251016f73561dd3cbb0872b5d781b2d30dba96451ff5da388fd483b
- SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7h:K0p1F/IiQEKZm+jWodEENh
- TLSH
  T1C7C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Pro/msvcp140_codecvt_ids.dll
- Size 40KB
- SHA256 3ad45d2800f13e5bedeb1e0fddfcd40c392622bb8649c4321992d097941518de
- MD5 74e1f207b7097f6a35cb073e948fca20
- SHA1 f8d00e910218659f08301761bbf4703e29958109
- SHA512 b68dde42ca484a498a9f7b56090dc6d73960cdc0dc75e47c334883a780b6747d32204733a719292c2d38be1b6b8b27485f0f2dd8c332ece40a4f070b99741fc2
- SSDEEP 768:2wA1mjzzGgU9IX+09zo8AjCf9zcfFJq09zoL:2wA1SzzG3e+czopjozM8czoL
- TLSH
  T1B8137DDADA788083EEDB5DB082A8DE877C3CA3C70A5095A71362F1540D537C5EB3426E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Pro/oneauth.dll
- Size 5.7MB
- SHA256 adf8a824a06c62fe92efb03ea07423e182609017f44e6a1ecc965a63e4513bd9
- MD5 c2de63ecf27c2c67943dde631298eca2
- SHA1 0f9d0309ebde88c473abd5498f2900461fe1107b
- SHA512 5467496f65cf578ae26c3b314d42378cc6a76bef435ac306dde5b5918f8ed08b2857f3720a5ce243345ae40a05bd7002214401df6de39d2aa02db526827a99fd
- SSDEEP 49152:YIphIXwBuXtFtLQQqB76mf8oR6L9BW0JOBKSTaCYgzyTMbKfujWZZmEDxP3AmT5f:Yo8o0/FQ0Mc9Aua6/3LLgtkt
- TLSH
  T112564B017ACBE598C0DAC47056438513AE507CDB0B39E9FF01E1F15A3FBAAB45FA5229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Pro/oneds.dll
- Size 3.2MB
- SHA256 af48988967bae769f3031f0d9fabc5ff7bdda72e8224050190a16988de21e611
- MD5 d2fd39d1eeb4f74da30d0e4a0c4a701c
- SHA1 0efaf97c0a7f477e4d9502b9ed168691c57eac78
- SHA512 8cdfd1cd1104fb34902ad1f15770fbdd21fca07b94658f21d37d7b55e7ec0c0ea6f35ae483d76e08fe6b760fec64e5030232b4eb63662376a4b2d7785d4503df
- SSDEEP 49152:oeqnNyCB3ocUrGaXdWycnZT+S2cKrVRzTMyBf4MVOZtDc:zq4XM7VcZRfceOZBc
- TLSH
  T1B1F56B03FA5641B9C08AC174C7678733AA713C8A4F74A6EF06A856153F7ABE05B3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Pro/onnxruntime.dll
- Size 3.1MB
- SHA256 1f11ded7a52be5994c8944ce4bd44d82e0a63c955688aa8e727cf22a9c65a42e
- MD5 f17a75200adbc2ee4ed315d7cedadc66
- SHA1 2cd0cb4e486ba2955f87d2faa3897d31ba15f6b5
- SHA512 488241130a49b82e988bac83932334305c2bbe5b5fb73a1cc0ac03811d577f78bde287695702b208bed5d9c2b1708c41ccbe984fa777110ee9569ec72f95be74
- SSDEEP 49152:89dUKzyhC/ni1yzbArKqzr/fpSILTSPtBgwZ4iruMF/cH9nmoh9kXpw9XpzwYMNg:VgBm
- TLSH
  T154E5AE2AA3E802E8C07FD179CA4B8A17EBB27449C3705AD703F185552F6BBE0567E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Pro/onramp.dll
- Size 457KB
- SHA256 eec93ba0b1117a912873f7bfc14d3036fa29f271d165c32a5bea95c3de771e07
- MD5 31fc305e4a030ced08b569b832e87ade
- SHA1 6c685bed65faa2b8bb4c9ff016c12cf0f371f565
- SHA512 fea0ff1ce0db9294718c46af610fae55e59afa2e1014268d9a399d26279c3495b7934cafa4c4a8704d025e378ce7fe1a5dc88902c35849bfb921dc32566b8637
- SSDEEP 6144:OrsZeXqDVPrg10lHXTGbdwS1DpVZk4xDcGNegh6td6f:OrsZeXK8IXKwS1DpVZkac8eghAc
- TLSH
  T1A8A48E05B7E448A9E076D1388A538947EB717C960B61F6DF03E0E2792F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Pro/optimization_guide_internal.dll
- Size 17.7MB
- SHA256 608239e89a43fc482cbdd283c42069671478534c0fded508d780dac603ac1611
- MD5 d31f5e7d0e950514c860430c5ccb8f43
- SHA1 d51cdf30bfc673e66a76953b2ba0de3b9555d1ab
- SHA512 294e511ebc65ff40cd28c88b8793afea01e69255c72c3b9312131ecc3c74474822c856625abf3ab4a80d5d74697f94dd1030675f740afd4125f97a0133ce8a1b
- SSDEEP 196608:U2mEIQDREt+AbmuTDILo12nvjUs5q9Z5j4Mc:6BbpPC/nvjUs0j4Mc
- TLSH
  T1BE174913E2A641D8C05AD1B9475A9233FA617C494734B2DF0B81BB122FB5FE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Pro/prefs_enclave_x64.dll
- Size 113KB
- SHA256 27ef7b33f09808b3f1b23a5d1f3bb057e5774104619b23b0908b620d074a41e6
- MD5 6284d259ba392db0e45ba4446a735863
- SHA1 71d484a0afd3b25996000566d24941d18ff458d3
- SHA512 3a1211577a933cb8d2136017fd0e6da4aeb6d76ae895172370e88088eff5b23e446d25cf9027e9a83ae3097e47f5e2d6c1ced636c09445f56078b2a2cf9146da
- SSDEEP 1536:2hk95BP9K5dv0EzEd1GP4ufY8OZjknvooLqF1Pm1Yzgizh:2i95BOMEgHY8mwoLqF1PmaPd
- TLSH
  T13DB36A46B26442B7E66BD175C5D31E0AEB74B4848370A3CF07A94A950F23BD09F3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Pro/telclient.dll
- Size 3.8MB
- SHA256 1c7ed563eb7a9385f2d6cbd4330ab9ec6cd9afac4dd8b6699408dce9f6686ac2
- MD5 72a851749f03221e668c335d84a31038
- SHA1 97ee67ba4827cb63f498c8e887818ec9c9514f75
- SHA512 9e6f871c2cbb27d8a56915af3b016b22557fc6cd710d65938ed9a703ce2835c0e3c9ae007c657ba57c4d7f369c003b7550d31fbece2f7f319ef3d6a1fbeb575b
- SSDEEP 49152:bBGDNi/dn6X3Hoeib4wDH0pWqx+Uo4Ok+QjDi46tpI5GMU4tgfjsoIIIQDN/5h:EcEoY0k+8yIBtwb5
- TLSH
  T154067C03F19901EAC09ED1799B5B8222FEA1BC454B35B2DF0A9477121E7AFE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Indicator Removal: File Deletion

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32