0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616

Sharing

Copy URL Twitter E-mail

General

Target
0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616.exe
Size 3.6MB
Sample260924-qa111aeb37
SHA256 0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616
MD5 330122a06ff07116214ee6e544a4da67
SHA1 ce5c450236bd4f20dfdae91884fd2ecff97ce3ff
SHA512 b9f84cbb86c03a7aba325fc86e8a09754247fb211f073c02fc47f985262705c357bbf4d77dc5f9fa4c410fbc5459d6d748da8325e137bea5686cfff2d9775e71
SSDEEP 98304:FHbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6+:F7qQ0onSwKJCrUL4Zx4TwPWm
TLSH
T182062315A3A858F5E2779334CC924217E6B27C254B31979F23E1079A3E373A0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616.exe
- Size 3.6MB
- SHA256 0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616
- MD5 330122a06ff07116214ee6e544a4da67
- SHA1 ce5c450236bd4f20dfdae91884fd2ecff97ce3ff
- SHA512 b9f84cbb86c03a7aba325fc86e8a09754247fb211f073c02fc47f985262705c357bbf4d77dc5f9fa4c410fbc5459d6d748da8325e137bea5686cfff2d9775e71
- SSDEEP 98304:FHbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6+:F7qQ0onSwKJCrUL4Zx4TwPWm
- TLSH
  T182062315A3A858F5E2779334CC924217E6B27C254B31979F23E1079A3E373A0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $EXEDIR/winrar-x64-710.exe
- Size 3.6MB
- SHA256 fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523
- MD5 468b0488243d15750b3cdecfa265093e
- SHA1 4735ce24fb34e9100effe00dbe514f604accbf07
- SHA512 0b1f516cea22df2c36c96dc97ab0b0ae1832c1feb20c8cbbf0c5c1c289c5941fbcef25e054bc78f09b9c9cb54d0bc22d5ea028810326824e1f91fb6ef73b4c96
- SSDEEP 98304:hbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6V:JqQ0onSwKJCrUL4Zx4TwPWN
- TLSH
  T1E2062319E7A858F5E1779278CC920207E6B27C254731979F22E1079B2F373A0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- TLSH
  T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
- MD5 c953dd0aab774f1446fcd63fa7c5f613
- SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
- SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
- SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
- TLSH
  T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8