b78509fa3fa48a4ad4016396a4a70c38875f5ae5286bb0d6819265d8fe8605d0

General

Target
malwares.zip
Size 3.6MB
Sample260823-prh13swgmf
SHA256 b78509fa3fa48a4ad4016396a4a70c38875f5ae5286bb0d6819265d8fe8605d0
MD5 2fa35da5be101e3eec321d0c3cda2067
SHA1 9349b5a051791421fd7334282c507054f05431d7
SHA512 6bebe523a5415f33878456af41029e7e2bc563ead6b904be7adab30411fb53cacb6b26d14c2ad6768f8ef07c7775c38763420acbb3dcc854a4bc5404a943db65
SSDEEP 98304:kBUW4qrezTW1BUW4ebIT8vNQBUW4mrezTWO:WpSeLcHFSL
TLSH
T1F8063348FD1F5DAFDA605B27508112008AB6C81DECF8F7953AE94231BD9F78BA12F464
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Choicer Voicer.rar
- Size 1.2MB
- SHA256 5f319d0ca14a3b42cbb67ea1770c28a8f4357c95082ec8475fed76f45064b730
- MD5 27aca7e86ca008dc4fc0b6e4b8501005
- SHA1 01e877f4038c5a2f75f60222ed19cfc5292cc3cb
- SHA512 0b28221a9d2d6f3dd98b1482fd992353ad67c80183ea3db72348a078f0932b42c78dd5f4c68853a2ac731938684f1c99cdd45d430f68c6d813ba0ee25b3cbd73
- SSDEEP 24576:sFt2DrRSfnTN+kM9B/aHtoIT6/NGmDLFFUfaq79bibrNez:/DtSITwuITONGmDR8aqKrYz
- TLSH
  T1D2453388BC1F5CAFAE608F17508112008BBACC5D9CF4F7923BF94135BA9F68B552E594
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2
- Target
  EX Tweaks.rar
- Size 1.2MB
- SHA256 f112a5e59d9fded027f3e23aa07f325a69a708c7eceef96cd4336aa5a9c657f7
- MD5 6c8d81e3a70e5d40ad30e16accafa6f0
- SHA1 640dee5f600f1002dbd693279cea1e2ec8a6bf60
- SHA512 85231ae125016af3db9d2403e0d7a0357737fe0688958cd192e70ac09fb7ed5708e929a26f4aad6dfe16767dec325cc10e2800cf3bf4d9d2172359070f58a9d4
- SSDEEP 24576:3Ft2DrRSfnTN+kM9B/aHtoIT6/NCmDLFFUfaq79bibrNe/:6DtSITwuITONCmDR8aqKrY/
- TLSH
  T1EE453388BC1F5CAFAE608F17508112008BBACC5D9CF4F7923BF94135BA9F68B552E594
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  VMTools.rar
- Size 1.2MB
- SHA256 9970160057a623718f7bb5a912ca744e0837edf6ded7aff01dd5516228be8f0c
- MD5 6443e504caf23f81fdb52318bc80f2ea
- SHA1 f50f7082abc4dbdb7464546bf80b1b8f6c74050f
- SHA512 6c14c15d120d0255b3b0f18ee4fdd0c0f44279eb0a39123cf9575f21ff6f098bf2634a3ee36c909c0227cc5e283135649e15b04ddbb0471e0bf39a9f5a3d3b88
- SSDEEP 24576:zFt2DrRSfnTN+kM9B/aHtoIT6/N4mJLFFUfaq79bibrNen:2DtSITwuITON4mJR8aqKrYn
- TLSH
  T160453388BC1F5CAFAE608F17508112008BBACC5D9CF4F7923BF94135BA9F68B552E594
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution credential_access defense_evasion discovery persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral5 behavioral6