bd037af47ce08289d7efd5428a30e87d38e1dde2e2ac3684b23af808d58d0b54

General

Target
Matrix.exe
Size 300.4MB
Sample260922-pyhznaef59
SHA256 bd037af47ce08289d7efd5428a30e87d38e1dde2e2ac3684b23af808d58d0b54
MD5 1c6601537d49c153ad8a18042b57a5c8
SHA1 4bdba206cb3adef41060c235e748b062c33711f8
SHA512 92eadb58d43b8426f8a471f4a825bd688c94b8fd256f380258247221b6e1d04f3d48a59ae32b164356c84edd7d1dea582e1e4f36e865952f5b017b46791f65eb
SSDEEP 6291456:UU9xaC4y93GsjnWkVXbD9RmTUjoVXhLNK9bU9xaC4y932sjnWkVXhbEE:7xj4yFFVX/ZQXBo8xj4yFVVXB
TLSH
T14EE83301E54504EFE58D5332F2F2922A7B97A8EE8BA5C5CE16D02D031BB72D8DD39D21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Matrix.exe
- Size 300.4MB
- SHA256 bd037af47ce08289d7efd5428a30e87d38e1dde2e2ac3684b23af808d58d0b54
- MD5 1c6601537d49c153ad8a18042b57a5c8
- SHA1 4bdba206cb3adef41060c235e748b062c33711f8
- SHA512 92eadb58d43b8426f8a471f4a825bd688c94b8fd256f380258247221b6e1d04f3d48a59ae32b164356c84edd7d1dea582e1e4f36e865952f5b017b46791f65eb
- SSDEEP 6291456:UU9xaC4y93GsjnWkVXbD9RmTUjoVXhLNK9bU9xaC4y932sjnWkVXhbEE:7xj4yFFVX/ZQXBo8xj4yFVVXB
- TLSH
  T14EE83301E54504EFE58D5332F2F2922A7B97A8EE8BA5C5CE16D02D031BB72D8DD39D21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence pyinstaller ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1