582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1

General

Target
582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
Size 8.4MB
Sample260910-3zf4caaj2y
SHA256 582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
MD5 124d4ec78746cf77c06398aea42da459
SHA1 e737229d88b8a57e3c54de9564a7cea400793d30
SHA512 12c8a27761c04bd8128d79e4f80c02c14489a2b29f5833b615d8e35e307aadeeb6d84eb5e8a501d55cc7c9d8c59c96ca1376bcab88015c79681d3bffb3f38b13
SSDEEP 196608:9Y7oStht/gkHgd9QinK3+ocgJSi8Ik80wwb8OmbLnRtMSUd:eTT/hHgdCJjk80ww8Om3Sd
TLSH
T17C963367025E9A6BD6DF63FE24B2D36EC488B1D4386A20C20B06F82F127D705E51DF91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
- Size 8.4MB
- SHA256 582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
- MD5 124d4ec78746cf77c06398aea42da459
- SHA1 e737229d88b8a57e3c54de9564a7cea400793d30
- SHA512 12c8a27761c04bd8128d79e4f80c02c14489a2b29f5833b615d8e35e307aadeeb6d84eb5e8a501d55cc7c9d8c59c96ca1376bcab88015c79681d3bffb3f38b13
- SSDEEP 196608:9Y7oStht/gkHgd9QinK3+ocgJSi8Ik80wwb8OmbLnRtMSUd:eTT/hHgdCJjk80ww8Om3Sd
- TLSH
  T17C963367025E9A6BD6DF63FE24B2D36EC488B1D4386A20C20B06F82F127D705E51DF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2