8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586

Sharing

Copy URL Twitter E-mail

General

Target
ep_setup.exe
Size 11.7MB
Sample260903-p9h4ssxeld
SHA256 8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586
MD5 a611f07c3b935ef80361cb326a6c659d
SHA1 660c5bb132cd03822b2982ad53cd1d1aee801a13
SHA512 e8c21dc4a746c50cf14fdead54a37d8d77b40ae6276118bb2797039ca9b741dc519521c3264283b4e31dc2af9448f6c0a60bf25fc7b4a40ba5d9b7f309074a07
SSDEEP 196608:LAvKGmJYCEKfMhjfGptv0jikRUEiyi5o2ItCC2bO+WxNtTYne/C5YbM1Vd+2AB5V:EKXOCEti4jikiEZijTCIKNtUnwYYA1K
TLSH
T118C633257BE209CEFA3BC37898B3110691A97D076B35D8BF9650059E4D33BE2C538729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ep_setup.exe
- Size 11.7MB
- SHA256 8146db4d3a87201fb80ad1d3712ba8f56883e9a0811758bd39f62d73a9f2c586
- MD5 a611f07c3b935ef80361cb326a6c659d
- SHA1 660c5bb132cd03822b2982ad53cd1d1aee801a13
- SHA512 e8c21dc4a746c50cf14fdead54a37d8d77b40ae6276118bb2797039ca9b741dc519521c3264283b4e31dc2af9448f6c0a60bf25fc7b4a40ba5d9b7f309074a07
- SSDEEP 196608:LAvKGmJYCEKfMhjfGptv0jikRUEiyi5o2ItCC2bO+WxNtTYne/C5YbM1Vd+2AB5V:EKXOCEti4jikiEZijTCIKNtUnwYYA1K
- TLSH
  T118C633257BE209CEFA3BC37898B3110691A97D076B35D8BF9650059E4D33BE2C538729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution persistence privilege_escalation ransomware spyware stealer trojan
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1