svcstealer | 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

General

Target
3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
Size 1.1MB
Sample260825-e3gmaawgrh
SHA256 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
MD5 dbcc02d992bceffe77a9ba0b4e225a63
SHA1 ce31a623ec16eecf82a8387d6a8f7ffa7f6dc9ea
SHA512 42e138e88c015104dcb70d714d63ecd833bf2e1f676b6d197a1b7d79e9ca28170e8e26700eaa872cd3ff7ac263d4544e0fc161134d4a156b31f41bdd3969d247
SSDEEP 24576:WNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:WNot3pgt9srKo68YZwnmKVjht
TLSH
T1BC457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
- Size 1.1MB
- SHA256 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
- MD5 dbcc02d992bceffe77a9ba0b4e225a63
- SHA1 ce31a623ec16eecf82a8387d6a8f7ffa7f6dc9ea
- SHA512 42e138e88c015104dcb70d714d63ecd833bf2e1f676b6d197a1b7d79e9ca28170e8e26700eaa872cd3ff7ac263d4544e0fc161134d4a156b31f41bdd3969d247
- SSDEEP 24576:WNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:WNot3pgt9srKo68YZwnmKVjht
- TLSH
  T1BC457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader execution svcstealer installer persistence privilege_escalation spyware stealer defense_evasion evasion exploit ransomware
- Detects SvcStealer Payload
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: SvcStealer, Diamotrix
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
  stealer downloader svcstealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2