a9cb6f77f937a757458868bf95c06f678775a15bfeb9013980db97eb111b4bb6

General

Target
Inkborn.zip
Size 129.3MB
Sample261027-nwad3add46
SHA256 a9cb6f77f937a757458868bf95c06f678775a15bfeb9013980db97eb111b4bb6
MD5 834fdf754eeba91fc620de54ee1d8458
SHA1 c674859d92647d26498b6666d06a0956746e6130
SHA512 8a6f247d7f2d78242673d612035458bf471de2cb9a60acd2fd66107ea9609e42d8471a810e0e18505f343eb78d3f609c6766e42b9d7e995cdafb148ff0615490
SSDEEP 3145728:zelOsLgOxGGWOav5xTp0Zs4GeSegLK11BQCPu:JWxzW3TOZox4gz
TLSH
T11758331773A562524F808DA320B18D48E35E3FCA3CE397701AD5D6095E78AEFF4D8626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  InkbornSetup.exe
- Size 129.3MB
- SHA256 8fa18c78c2f4bb9dd7289f8a1e824e2af58d2ee4706edf1ba78211ef345ed664
- MD5 dcc62b4d32328e9597cc44f4a098ec81
- SHA1 ae5c445be0812fd478cb2b975529a2dd2aa9761a
- SHA512 fbcb655582d1b1fc122599f17283a71f0f6c85203a54f796bb4867d11519700c73243a83d71759abeaa632c48583a28bc152ca46017a4b8ad2fe6ac5e08214ef
- SSDEEP 3145728:+0BY8RKqLC6WW6bnzP50xCCIa6gu/OfJhec1c7:0yLxWbPWxUZ6mJ
- TLSH
  T1ED58331773A56252CF808DB310618D58E35E7FCA3CE357601EC5E2095EB8AEBF4D8626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1