b83867353d0574296e850fc2feb6fbd6dff45961517e14ffab243c7b4ed943b2

General

Target
Moon Dev Code App Setup 1.2.1.exe
Size 88.5MB
Sample260913-w3ddast1ft
SHA256 b83867353d0574296e850fc2feb6fbd6dff45961517e14ffab243c7b4ed943b2
MD5 060ce63efb4866a946abbd73a5df19d3
SHA1 f068f110fc10855f80e9e830e6b3a73727bc3baa
SHA512 9ad3197c3d9a81f8b2ab6249474adc06851f1ba075d7badee3141608f894b780a92872ee7d6a671e0b40161085571db5b8774bcb9e69b767a0195098d2ed6bc9
SSDEEP 1572864:F+KLNOOz4PsyfyR4FZdx8S5Q6iwWTgu5Up+iETvGYOMcHD5a1ayQL57C5an7yZKQ:F+KPzKasZT5QyjGUEilDXD5MQC5an2Xt
TLSH
T11F1833235F49E8C1E5112F79BC839C3415BB2940A63880861E9A986FB364A537F5FFD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Moon Dev Code App Setup 1.2.1.exe
- Size 88.5MB
- SHA256 b83867353d0574296e850fc2feb6fbd6dff45961517e14ffab243c7b4ed943b2
- MD5 060ce63efb4866a946abbd73a5df19d3
- SHA1 f068f110fc10855f80e9e830e6b3a73727bc3baa
- SHA512 9ad3197c3d9a81f8b2ab6249474adc06851f1ba075d7badee3141608f894b780a92872ee7d6a671e0b40161085571db5b8774bcb9e69b767a0195098d2ed6bc9
- SSDEEP 1572864:F+KLNOOz4PsyfyR4FZdx8S5Q6iwWTgu5Up+iETvGYOMcHD5a1ayQL57C5an7yZKQ:F+KPzKasZT5QyjGUEilDXD5MQC5an2Xt
- TLSH
  T11F1833235F49E8C1E5112F79BC839C3415BB2940A63880861E9A986FB364A537F5FFD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution motw phishing spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1