19ed8836219a8f13a5f6307c46fd40e1adef4eb59f81fa7e87cf407ee020ea91

General

Target
Lazybeard [LeanCheats.cc].exe
Size 14.3MB
Sample260827-2pp3tsdq51
SHA256 19ed8836219a8f13a5f6307c46fd40e1adef4eb59f81fa7e87cf407ee020ea91
MD5 dd2433c27f1e64a725b27b851b1f6b05
SHA1 bd430412ed8a8685824873df330e4737581fbfc1
SHA512 e3e6b78b487d2765de0e0d8aea10ba6b97d7c98eed614e910c921ca187947885f119417dc72d3c5cd18b2292de4eab4303d17a1a2c9a6a04ccd2a7e9a4b65671
SSDEEP 196608:A6kFuNdVEerFS2U3E/wvvGJSbleNV2oo0nSpnURY5czI:AARP5/J6eTjo0nSpGM
TLSH
T1B0E6AE16E3FC02A9E6BFC278C5A64517E7B278451720DBDF115486A92F33BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Lazybeard [LeanCheats.cc].exe
- Size 14.3MB
- SHA256 19ed8836219a8f13a5f6307c46fd40e1adef4eb59f81fa7e87cf407ee020ea91
- MD5 dd2433c27f1e64a725b27b851b1f6b05
- SHA1 bd430412ed8a8685824873df330e4737581fbfc1
- SHA512 e3e6b78b487d2765de0e0d8aea10ba6b97d7c98eed614e910c921ca187947885f119417dc72d3c5cd18b2292de4eab4303d17a1a2c9a6a04ccd2a7e9a4b65671
- SSDEEP 196608:A6kFuNdVEerFS2U3E/wvvGJSbleNV2oo0nSpnURY5czI:AARP5/J6eTjo0nSpGM
- TLSH
  T1B0E6AE16E3FC02A9E6BFC278C5A64517E7B278451720DBDF115486A92F33BD09E39322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2