1c05e2a63ca3e53ac4362eed9ef329a83d4efdc9246153aea0c24a4f9a7e6868

Sharing

Copy URL Twitter E-mail

General

Target
FastFind-0.92.0-Setup-x64.exe
Size 2.7MB
Sample260909-jj97pstfla
SHA256 1c05e2a63ca3e53ac4362eed9ef329a83d4efdc9246153aea0c24a4f9a7e6868
MD5 5dc8ad01f8bb2365eeef4f9bbdbc4493
SHA1 b7c32a43a413ce00e27397f5634bf7501f3f09f1
SHA512 1360dd1968cc00bbdeb5204981cbcfd58fded46b3ec4c4599a03274e4c27ec13cb797a19f6fabc34fbbd465c61f7481d75de949dccf9b68a92f14566eabfdf91
SSDEEP 49152:9uYIt/KvS8ywKEpfKkNNQqZrVxM8m0ZbNmFo5gzq2u:bEP8/FNQqtm0OF3W2u
TLSH
T1F2D5E1F28003456BE8E54A34B072C4F5E8928D3C734A25699B5F7B3EE5F538D6A2740B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FastFind-0.92.0-Setup-x64.exe
- Size 2.7MB
- SHA256 1c05e2a63ca3e53ac4362eed9ef329a83d4efdc9246153aea0c24a4f9a7e6868
- MD5 5dc8ad01f8bb2365eeef4f9bbdbc4493
- SHA1 b7c32a43a413ce00e27397f5634bf7501f3f09f1
- SHA512 1360dd1968cc00bbdeb5204981cbcfd58fded46b3ec4c4599a03274e4c27ec13cb797a19f6fabc34fbbd465c61f7481d75de949dccf9b68a92f14566eabfdf91
- SSDEEP 49152:9uYIt/KvS8ywKEpfKkNNQqZrVxM8m0ZbNmFo5gzq2u:bEP8/FNQqtm0OF3W2u
- TLSH
  T1F2D5E1F28003456BE8E54A34B072C4F5E8928D3C734A25699B5F7B3EE5F538D6A2740B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 db6b3d7276c551221d55520dfc94acc175d2dcd7370ade38a667bf0fdf6a9cfa
- MD5 d04a06a05a6aee6b49baf107edc1eebb
- SHA1 7c74c9317588dcb9004746d288caa82cf788c0ff
- SHA512 3e7ce0e10164f1c80df102066cf2338498fa0e35f425abfb698a1a1dc95c1bb6460e2e5c2c53a7a5d3843bb4480308cca35ad23e852c28cc9731941b85ba6c88
- SSDEEP 768:0S7Mk5dmwtmKInwop3Rrxv8UeqYFahSTmB9K:z7Mk5d5mKIRpBqUeqyfk
- TLSH
  T135D2190AFA42CCF3D072D67488CBF63789166D3AA72A4677FE6F4E197C27650590D102
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 5683357273097ca8641a98e3590e4e7b75c972e1063299a1429abdee2d2b18d5
- MD5 b6c7dc4ef7032f11ecf005eea0724655
- SHA1 059e5da3c9458cbe95f458f139c23f04c20b16c1
- SHA512 0206f6f8295f02dad7f54dc656a448bdd5fcdd17cf38ca23b024732274e01aa712d8c0975948099c6c5803d946440fa1b53dde29e71bcd1082f61ba20b1ac909
- SSDEEP 192:qlWWGk581HwPf5G/QocFR1w5kYkv/RelBBoiE+6SZS7Emk8:ZPk5Sof5G/QocFR6OYkvUlBBoij4T
- TLSH
  T1A652E50EFB0A44F6C572D831648BE72F869DA415C66B4E06EF170B0CBCA72B5281E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 10KB
- SHA256 61f0e47b09316d39979c62a05403a3baa3ee58841dfd97cc00fb4dc086843815
- MD5 aac4f3facf83975d0cf2b02200ae8212
- SHA1 8ea89129df40923951610b6f003c10ab7c5cb238
- SHA512 b0d4a5f2c129ac39e55ee20ffcf8fe1306b0ba791ec9ade8249a3304e091941476a032089e22a7e1ffb709f6e0a591d026091707754a387e147fcc6af996336a
- SSDEEP 192:CCtx8+SjrhYnUMu3Oad9z3Ykv/RWwCh3srduaO4:vx8+SvhYnBu3Oad9z3YkvcwCh3srdu
- TLSH
  T17B2296C9BB0579F5D0639934B18AF12F4DA97C31CA2B840EE89A1E35B82F5E4571DB03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  FastFind.exe
- Size 7.0MB
- SHA256 093be52b9cc0f4472888418dd24b6a207019d6afd9717605f452457a78cd6292
- MD5 deac550717b5be684dd6b7d3f5b307e3
- SHA1 0de6f43eba2e506b546276cfbe41f3b247142e01
- SHA512 b2acc5d3041d51a1eb8371c9afaf9df3655c942ef142a44acd27bb874b17f5894e4e666b11c96afbfc97a686b5b43f03192af095725e7f02a214de324265051c
- SSDEEP 98304:4KeR7N/NennVtOsuqc5WhzDVSGGEw29F5f/Oa:Cz9ARzP0
- TLSH
  T177764A43F66380FCC0AAC074831A6172FB61BC4D45367A6B5B94BB353EB5B50AB1DB09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution persistence spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9