5b89f98e1cfc2b6542502af1f32185f2d95c1474b17f25faf17771709c5b1fa7

General

Target
NDGY9EAP7LGPLV.exe
Size 14.0MB
Sample260824-vlsk8aap3y
SHA256 5b89f98e1cfc2b6542502af1f32185f2d95c1474b17f25faf17771709c5b1fa7
MD5 a9533863023e6eb5da589cba43325cee
SHA1 f3313aede5fff1911f6b28010b8cf5bdc3f73d82
SHA512 8e8799687cfb6155f082fc15481af8d5ef7b683e3b047d4191b0deb1a07f3848e0d8c8da2d30e3fda3ac6e0cbbe435482833c3ba6f768f35d00ccc6ddff7c40d
SSDEEP 393216:+cifESxO4l3yULe5FG0JPJBfYPxfa7Ynlj290:+cOLe5wQPJBgJf60K9
TLSH
T13BE633FBC7147A27DA1AA23B33494CA9189E56590789F221E5CDAD83333BBF063F5105
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NDGY9EAP7LGPLV.exe
- Size 14.0MB
- SHA256 5b89f98e1cfc2b6542502af1f32185f2d95c1474b17f25faf17771709c5b1fa7
- MD5 a9533863023e6eb5da589cba43325cee
- SHA1 f3313aede5fff1911f6b28010b8cf5bdc3f73d82
- SHA512 8e8799687cfb6155f082fc15481af8d5ef7b683e3b047d4191b0deb1a07f3848e0d8c8da2d30e3fda3ac6e0cbbe435482833c3ba6f768f35d00ccc6ddff7c40d
- SSDEEP 393216:+cifESxO4l3yULe5FG0JPJBfYPxfa7Ynlj290:+cOLe5wQPJBgJf60K9
- TLSH
  T13BE633FBC7147A27DA1AA23B33494CA9189E56590789F221E5CDAD83333BBF063F5105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

upx credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2