0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c

General

Target
SystemUpdater.exe
Size 31.7MB
Sample261026-pg9q2ssx2m
SHA256 0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c
MD5 4da2429b8cde5e987a1f5b63e85e004e
SHA1 011bbfc65db8fafe486d4398af3e856577edc137
SHA512 5e969a3eb8de27194f198a073a935db3e6d5f09cccdbb6b66fd7125ff47da009c38230cd3368aaaf3752b76252280c2c077c694a90cbd5b3a13dce6f3059fd31
SSDEEP 786432:IdtdHLYNANly7w6L1RrhsqP6bxW2aUg19PzjoS/Zp:Q3HLYNSlyDL1RrfP6U9PXoEZp
TLSH
T13F77334642D601A7F4ABF1387947C052D7B2B85127928DAF0B5943CC6DAB2DB2F36722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SystemUpdater.exe
- Size 31.7MB
- SHA256 0df3202d6a61ec93a8a195f3cdf942a7e2727eb91c9eb71cfe06ddc85187a31c
- MD5 4da2429b8cde5e987a1f5b63e85e004e
- SHA1 011bbfc65db8fafe486d4398af3e856577edc137
- SHA512 5e969a3eb8de27194f198a073a935db3e6d5f09cccdbb6b66fd7125ff47da009c38230cd3368aaaf3752b76252280c2c077c694a90cbd5b3a13dce6f3059fd31
- SSDEEP 786432:IdtdHLYNANly7w6L1RrhsqP6bxW2aUg19PzjoS/Zp:Q3HLYNSlyDL1RrfP6U9PXoEZp
- TLSH
  T13F77334642D601A7F4ABF1387947C052D7B2B85127928DAF0B5943CC6DAB2DB2F36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2