ad263d95f00b7810f9a7902b4ac7348b7f255b53b34b42699a98dacb63321e02

General

Target
XNXXInjector.exe
Size 397KB
Sample261022-zd98hsbe37
SHA256 ad263d95f00b7810f9a7902b4ac7348b7f255b53b34b42699a98dacb63321e02
MD5 ff4466b514688e54bfec9fd396cc8a66
SHA1 6b02e0093739ceb3bd28652a40670a692651d1ba
SHA512 38e13add374e4e60635c341223fbd0ddd3ce58782cfd4dc4c27594f1655e83c42e8e8b84db3f4a35cefefd189781fc5ea516a519c948986d443b6ff186b9f2b1
SSDEEP 6144:K6s6BhXfjbeId+ePFJ5/+67vbsH1Ig9Fa5kZht09pnbMV6WYNlzOu:K6hXfjbeIdzWlVrseW9pnB3Ou
TLSH
T19A848D85F1A440EBD06BA074A1B7F60BF935388D475059CB77F848982FE36E07EBA611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  XNXXInjector.exe
- Size 397KB
- SHA256 ad263d95f00b7810f9a7902b4ac7348b7f255b53b34b42699a98dacb63321e02
- MD5 ff4466b514688e54bfec9fd396cc8a66
- SHA1 6b02e0093739ceb3bd28652a40670a692651d1ba
- SHA512 38e13add374e4e60635c341223fbd0ddd3ce58782cfd4dc4c27594f1655e83c42e8e8b84db3f4a35cefefd189781fc5ea516a519c948986d443b6ff186b9f2b1
- SSDEEP 6144:K6s6BhXfjbeId+ePFJ5/+67vbsH1Ig9Fa5kZht09pnbMV6WYNlzOu:K6hXfjbeIdzWlVrseW9pnB3Ou
- TLSH
  T19A848D85F1A440EBD06BA074A1B7F60BF935388D475059CB77F848982FE36E07EBA611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Drops file in System32 directory
behavioral1