vryxen | abf45599bd5975e37c1e8e98c393e12c710414fa32a8b0dc34d609ac71ecb594

General

Target
a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.zip
Size 4.4MB
Sample261012-sdps9asz9p
SHA256 abf45599bd5975e37c1e8e98c393e12c710414fa32a8b0dc34d609ac71ecb594
MD5 c96180a5b4d250aef1f27aabe50d6b0d
SHA1 7823b487fba01faa8e416f003bcb71b0d2b458cd
SHA512 51fd3d4a32212cfdad7e884723847726f844a3109868fdc5c8b0a5c7da24058b84cbd646ce1b987c88f91350b884b414478cf144f89529e3c67ecefae50f316b
SSDEEP 98304:KD13PYS647NHK0EGQZwlfevLBBTm2PKETe4jDiMlE7:KlYW7hKVGQulf6NNTjDiu4
TLSH
T1762633C3429DE425D77BBEA2CD5E8009375313ADF5C78EEA85BA391DBC4984890613F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9
- Size 10.5MB
- SHA256 a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9
- MD5 135c5c1831f1788709057fdd5b7b1cd0
- SHA1 8da7b9c422ca5ea933b7e2ce77bfff4d60a9bd6a
- SHA512 cc4099978950760a88673c0e464c9a84819514d2b5ed23d3406f36ab36fb8af7d8966ecdcdd283e7b4586f4235ad19fc1c8aa3a9c70fb8e8b18d46b18159d087
- SSDEEP 98304:jfxwSs1ZgWBY08oiCbU5nn9Jb+ywx5Wp79IF8B+NE:jZwHUWBZ8oto5Cy791
- TLSH
  T15DB64B47E8B541E9C0ADD5358A669123BA713C884F3423D72B60FB682F77BE0ADB5740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution vryxen persistence privilege_escalation spyware stealer trojan
- Detects Vryxen stealer
- Family: Vryxen
  Vryxen is an open-source stealer written in Golang.
  stealer vryxen
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Detect suspicious telegram bot
  Detect suspicious telegram bot.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2