466d646464fadba5c76502241e24220de19bbaf379d1c66c9999f002e7af1a87

General

Target
veter.exe
Size 438KB
Sample260925-vecana1fjc
SHA256 466d646464fadba5c76502241e24220de19bbaf379d1c66c9999f002e7af1a87
MD5 2f2fcfa937ac5fd5172f26d8e3565ee2
SHA1 b1e937cce65955abc3fa7089eb4b806b35ac3937
SHA512 25b3a283c456b5dfae9b03f46cadfc4792976a67a4e0edcef7955323d6259b01530544ab086cb79417c9e73c198dd7c4bc4486109ad647ad97afd631b1250190
SSDEEP 12288:gCtlRUHzmtQIvQnB/T8MMvqpal0GupnPxMeJIGRksvj7pdZGqWSlzOl5jQX2vFM:nRuIYnZYMMvqpal0GupPxMeJIGRXvj7
TLSH
T1C194292CBA10CAF2C7FE4EF0494A3A2B9B7551AA4E417EEF154386F73C456A5F8006C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  veter.exe
- Size 438KB
- SHA256 466d646464fadba5c76502241e24220de19bbaf379d1c66c9999f002e7af1a87
- MD5 2f2fcfa937ac5fd5172f26d8e3565ee2
- SHA1 b1e937cce65955abc3fa7089eb4b806b35ac3937
- SHA512 25b3a283c456b5dfae9b03f46cadfc4792976a67a4e0edcef7955323d6259b01530544ab086cb79417c9e73c198dd7c4bc4486109ad647ad97afd631b1250190
- SSDEEP 12288:gCtlRUHzmtQIvQnB/T8MMvqpal0GupnPxMeJIGRksvj7pdZGqWSlzOl5jQX2vFM:nRuIYnZYMMvqpal0GupPxMeJIGRXvj7
- TLSH
  T1C194292CBA10CAF2C7FE4EF0494A3A2B9B7551AA4E417EEF154386F73C456A5F8006C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2