2eefa06f689c59a05df8c3845822676480c8f9b0d3100757fe9dbafc27b8b323

General

Target
Spotify.exe
Size 55.3MB
Sample260913-s8ddpsygpb
SHA256 2eefa06f689c59a05df8c3845822676480c8f9b0d3100757fe9dbafc27b8b323
MD5 f4872410145ebc0cc6b62399e02decae
SHA1 356945c5cf2d9fdf7db14b74c98c9bf553bdb36f
SHA512 93b027638b40c15536663c9a07fb1974cfdcf3686faf8f2b76f203948c3f5289ccef9a9d40d25dab539ddb3881211f9d21028acaaa3440d5df6cf9c51076d6d7
SSDEEP 1572864:EPXK5YEnyjptTYxZLH3kHbr/WWepZOpAHKXEBtvgUiMy3:EPXpEsp9Yx53+jWW+IzEHoUiME
TLSH
T12FC73306BCE618F9C5BEF130865193527AB2786443347BD32F84A97A2A76FD42E3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Spotify.exe
- Size 55.3MB
- SHA256 2eefa06f689c59a05df8c3845822676480c8f9b0d3100757fe9dbafc27b8b323
- MD5 f4872410145ebc0cc6b62399e02decae
- SHA1 356945c5cf2d9fdf7db14b74c98c9bf553bdb36f
- SHA512 93b027638b40c15536663c9a07fb1974cfdcf3686faf8f2b76f203948c3f5289ccef9a9d40d25dab539ddb3881211f9d21028acaaa3440d5df6cf9c51076d6d7
- SSDEEP 1572864:EPXK5YEnyjptTYxZLH3kHbr/WWepZOpAHKXEBtvgUiMy3:EPXpEsp9Yx53+jWW+IzEHoUiME
- TLSH
  T12FC73306BCE618F9C5BEF130865193527AB2786443347BD32F84A97A2A76FD42E3D314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2