8264fe8ef55770bf4f20771439420c4a9228c6172970057cabe14ebca1ab4381

General

Target
8264fe8ef55770bf4f20771439420c4a9228c6172970057cabe14ebca1ab4381.bin
Size 1.4MB
Sample261027-a9mpnahw7s
SHA256 8264fe8ef55770bf4f20771439420c4a9228c6172970057cabe14ebca1ab4381
MD5 3f7d43c93013bc9acbc06f2a5d0f25a7
SHA1 df7124b1913369737b7f858510807bd9774a9f37
SHA512 f05fc4bc37e1c64ae171982fea4a2872db6796455f02c0ecb5052ed9d27082d046d3735f8d05f7695d90082b13d95da9cb04cbf1d6104a173c506858b2b5c93d
SSDEEP 24576:Vsyah+77v9y8odu9+5WEt+R0HDCtjKM6MLZXHhXwXjDQqUReXllqFk:daAPo8oy+5W4+R04jKMnFZw8RwHq
TLSH
T1FB65235D27E621B2D479537540F602D75A34BC73B79A83EF1294E53ACE212C0AA32F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  8264fe8ef55770bf4f20771439420c4a9228c6172970057cabe14ebca1ab4381.bin
- Size 1.4MB
- SHA256 8264fe8ef55770bf4f20771439420c4a9228c6172970057cabe14ebca1ab4381
- MD5 3f7d43c93013bc9acbc06f2a5d0f25a7
- SHA1 df7124b1913369737b7f858510807bd9774a9f37
- SHA512 f05fc4bc37e1c64ae171982fea4a2872db6796455f02c0ecb5052ed9d27082d046d3735f8d05f7695d90082b13d95da9cb04cbf1d6104a173c506858b2b5c93d
- SSDEEP 24576:Vsyah+77v9y8odu9+5WEt+R0HDCtjKM6MLZXHhXwXjDQqUReXllqFk:daAPo8oy+5W4+R04jKMnFZw8RwHq
- TLSH
  T1FB65235D27E621B2D479537540F602D75A34BC73B79A83EF1294E53ACE212C0AA32F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1