Extracted

• • Target
    CoupleMod Installer_1.29.bat
  • Size 121KB
  • SHA256 e35bdd8f09e285cb5767c6861501be85763a03edb410bfa0f8b39b940f9eafee
  • MD5 535874d7eea0c2f5a7217cb6a6749233
  • SHA1 e47f3117391c35f1b6db5607749257210408da42
  • SHA512 c14b4a5f58039e1e4625b9d3e3047a75e962b777eef9889212c198a7a20f065875c2a3dd02576e5c2686dff4a0ea4590b216e8844b3ef727987f18bb2dd74951
  • SSDEEP 48:AldKSuBKSVB/BSzxMqTHlZtLXr7iANPNFq:ADlUzeBnDNm
  • TLSH
    T1E3C331983E2D909601BBDA948D710D56F50A018BC6114FFBB82E95A11F043C2F7EF4C8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    CoupleMod_1.29.dll
  • Size 279KB
  • SHA256 2ada75decdfd82adccc1df4d9655b3a6a6ccf83021d607e447292ccd5cff9663
  • MD5 098735bc2b98eaa23658b74863bcbb82
  • SHA1 afa18b4646cfbcf334f5c34a07474f0615efe5f4
  • SHA512 98acd1f2ffa1ac1846dd6aa242ccfe3a32064e8d3ad41992cb6e002a444f8f76f12eec7423939ac3ac2a4a665232a7f5c8e2085c5e573813aad4a8a9c6fcac2d
  • SSDEEP 3072:FAjW6xjISp71vZ7hoa4zPTFn5T/5iQVsa:ajW6xjISp77maiPTpxhiGs
  • TLSH
    T13B547D1167AC8F33D26E07FF78A010460BB18267B523FBC99DE9B4ED2492BD116152DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4