ccb90484fb60bafb99f9f8cd65b288a32d2891752c30f657d6c42aeee4fde07d

General

Target
jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe
Size 428KB
Sample260910-cvhs9sef75
SHA256 ccb90484fb60bafb99f9f8cd65b288a32d2891752c30f657d6c42aeee4fde07d
MD5 bad7bb80c0fc82d99ea7c6951da3cb80
SHA1 069fe4b707bf9e277084b8db6fd60ca738cd5db8
SHA512 909e9957736eb85b5611597c4cc9a929aec84d28081a195895fa20ce5784334ee8e4f161cba10063038a746bcf4ca6a872f6341f9405475625795d6e0146e725
SSDEEP 6144:OPylBjgAcSD3Dty9ZCOfVavfqfS5cNIdVQXcacVZWfiIblQlHBxaeJofgz:iyHghSDTtyu2Ivz5cN8zdAfiOlcae2Yz
TLSH
T13E940219B85ACC22EC15407B059AA6C5AF6D3D633AA30463FB4D394ED2FC3D44A39335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe
- Size 428KB
- SHA256 ccb90484fb60bafb99f9f8cd65b288a32d2891752c30f657d6c42aeee4fde07d
- MD5 bad7bb80c0fc82d99ea7c6951da3cb80
- SHA1 069fe4b707bf9e277084b8db6fd60ca738cd5db8
- SHA512 909e9957736eb85b5611597c4cc9a929aec84d28081a195895fa20ce5784334ee8e4f161cba10063038a746bcf4ca6a872f6341f9405475625795d6e0146e725
- SSDEEP 6144:OPylBjgAcSD3Dty9ZCOfVavfqfS5cNIdVQXcacVZWfiIblQlHBxaeJofgz:iyHghSDTtyu2Ivz5cN8zdAfiOlcae2Yz
- TLSH
  T13E940219B85ACC22EC15407B059AA6C5AF6D3D633AA30463FB4D394ED2FC3D44A39335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection defense_evasion discovery spyware stealer upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Looks for VMWare drivers on disk
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2