2cb044939e06ceabfa422c27e4f21d9f44088b7775d04f17ea4a1571d3b0d78d

General

Target
Prestige-Client.exe
Size 133.3MB
Sample261009-yzlllstses
SHA256 2cb044939e06ceabfa422c27e4f21d9f44088b7775d04f17ea4a1571d3b0d78d
MD5 c8b0f364a92e5eea2be9354817859441
SHA1 ace76f3d74cfd27de4fcc1fb52c8273e06333b16
SHA512 e6a79c708f34922ba875009b21bdf903e3dc32118ede41297ff183dd669d0013c08e73c13c8ec6d1d0036f8374374b4491efd9cc0f2b6d67fa7f1b6ea869ced1
SSDEEP 786432:zeDonrqdByAl8z/bbOH0cFl1wcd6b636g0nTAt+7O8Cy9X6KPuZkUqG/G:zG2rqNRF7p0n/yw9X6KPuL//G
TLSH
T1E2689D14A3E80715E27F82BDD6738212E6B1B8531361D2CF0499DA493FA3BD19A36377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Prestige-Client.exe
- Size 133.3MB
- SHA256 2cb044939e06ceabfa422c27e4f21d9f44088b7775d04f17ea4a1571d3b0d78d
- MD5 c8b0f364a92e5eea2be9354817859441
- SHA1 ace76f3d74cfd27de4fcc1fb52c8273e06333b16
- SHA512 e6a79c708f34922ba875009b21bdf903e3dc32118ede41297ff183dd669d0013c08e73c13c8ec6d1d0036f8374374b4491efd9cc0f2b6d67fa7f1b6ea869ced1
- SSDEEP 786432:zeDonrqdByAl8z/bbOH0cFl1wcd6b636g0nTAt+7O8Cy9X6KPuZkUqG/G:zG2rqNRF7p0n/yw9X6KPuL//G
- TLSH
  T1E2689D14A3E80715E27F82BDD6738212E6B1B8531361D2CF0499DA493FA3BD19A36377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1