49f37497c433a9b8c764508f966e65c0afa4e68d3803d68a4a113922ff522cae

General

Target
jaffacakes118_More HackingComputerized Governmental Database Systems Containing Persona.txt 40.34 kB by Scarlett Johons .exe
Size 432KB
Sample260910-elkbvafk4v
SHA256 49f37497c433a9b8c764508f966e65c0afa4e68d3803d68a4a113922ff522cae
MD5 bfff03cda01f5ef64852a06e1682dad6
SHA1 268f7f89e30011d6e7e883c489a2c769c6228bdb
SHA512 5f52bdb332537119bc3550530ed92bc754f1c9dbb16251566951f1ba7027739c9ec0e183e9b30a6714c0aee5ff1cfd2539320a7f2286d5fcb02e959947e2bd80
SSDEEP 6144:uPylBjtAcSD3Dty9ZCOfVavfqfS5cNIdVQXcacVZWfiIblQlHBxaeJofxE:CyHthSDTtyu2Ivz5cN8zdAfiOlcae2JE
TLSH
T1CA941219B857CC22E814447B46DAA2C1AFBD3D633AA30467EF4D390ED2F82D44A39375
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  jaffacakes118_More HackingComputerized Governmental Database Systems Containing Persona.txt 40.34 kB by Scarlett Johons .exe
- Size 432KB
- SHA256 49f37497c433a9b8c764508f966e65c0afa4e68d3803d68a4a113922ff522cae
- MD5 bfff03cda01f5ef64852a06e1682dad6
- SHA1 268f7f89e30011d6e7e883c489a2c769c6228bdb
- SHA512 5f52bdb332537119bc3550530ed92bc754f1c9dbb16251566951f1ba7027739c9ec0e183e9b30a6714c0aee5ff1cfd2539320a7f2286d5fcb02e959947e2bd80
- SSDEEP 6144:uPylBjtAcSD3Dty9ZCOfVavfqfS5cNIdVQXcacVZWfiIblQlHBxaeJofxE:CyHthSDTtyu2Ivz5cN8zdAfiOlcae2JE
- TLSH
  T1CA941219B857CC22E814447B46DAA2C1AFBD3D633AA30467EF4D390ED2F82D44A39375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection defense_evasion discovery spyware stealer upx
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Looks for VMWare drivers on disk
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2