1ec87bbff6d9901f43267d35a9aa814a052e7cf2afef8b584bccd997168c2a69

General

Target
1ec87bbff6d9901f43267d35a9aa814a052e7cf2afef8b584bccd997168c2a69
Size 109KB
Sample260916-1b7v2see28
SHA256 1ec87bbff6d9901f43267d35a9aa814a052e7cf2afef8b584bccd997168c2a69
MD5 bf93501f3eae7e32deb41761d0118fe4
SHA1 67b1ba6dd5006f326584f1cf919ee9db652c8c72
SHA512 12c8e6216113bff305993c49dd9f995e38f3267ad58d6d4d2abb1eb63e0d6bff07a5956e0f6442362ad969da62103a97bf37dd5cda0dde737b8278a5f839d28c
SSDEEP 3072:ONC7R3+EcP2fhX1WBCmw+GciS50a1fr2:Ow8125lIC5wx1D2
TLSH
T15FB30192B2A38744E2DA1FBD2583CE457258BC7003446BE357B57A6E2EB87C0D5B2858
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  1ec87bbff6d9901f43267d35a9aa814a052e7cf2afef8b584bccd997168c2a69
- Size 109KB
- SHA256 1ec87bbff6d9901f43267d35a9aa814a052e7cf2afef8b584bccd997168c2a69
- MD5 bf93501f3eae7e32deb41761d0118fe4
- SHA1 67b1ba6dd5006f326584f1cf919ee9db652c8c72
- SHA512 12c8e6216113bff305993c49dd9f995e38f3267ad58d6d4d2abb1eb63e0d6bff07a5956e0f6442362ad969da62103a97bf37dd5cda0dde737b8278a5f839d28c
- SSDEEP 3072:ONC7R3+EcP2fhX1WBCmw+GciS50a1fr2:Ow8125lIC5wx1D2
- TLSH
  T15FB30192B2A38744E2DA1FBD2583CE457258BC7003446BE357B57A6E2EB87C0D5B2858
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

command_and_control credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1