7d371107099cd6d3a64ffbf91ff13c66e7224effbef4ae3d6379bfc863e1b29e

General

Target
GC.Guesser.zip
Size 25.2MB
Sample261030-d3nj6avyds
SHA256 7d371107099cd6d3a64ffbf91ff13c66e7224effbef4ae3d6379bfc863e1b29e
MD5 b73e52114041a9d1636573bb0d189249
SHA1 18cbdb79dc7f845e9d7a176aee04beea425f28fe
SHA512 e15896e6f7a9396b5d4d71f01b9ebe03e806ce494baf1b7288652b5375aea7d32cbf7f13da4d46b83a43d3c23ee3dffb2c417727f902d8cd2456a50bf58f3458
SSDEEP 393216:z0++Ad1xr0tqCzGdZvDbNTQhNmye0DciMhHID8Dmnilhony5lZVmXQGTTj7RaMz:z0hAbC8dBDqhNmyTz6tzh5EQGTkMz
TLSH
T11747335941DBE7F6F297F068B4516B96BA0F4078711B8C30FFA080B60C8ADE59625B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  GC Guesser.exe
- Size 25.3MB
- SHA256 094975ce605f6d70f064bbdcee7ab8d319a1c2db8e446c35c03ac240bc28e7f1
- MD5 a36bb79e9c60ac16d114ba670a32332b
- SHA1 b3793128c3759b656b204b9c6b08c002b4cf98b4
- SHA512 9e7858e11c760dbcc97d3ba498c03061fc0f94a3645e126e5756bf2456820d160650a1057b0e7d92c76eac4571c1c91bb71f7bff30d24344a10174775f56dba7
- SSDEEP 393216:140HCl79NODcUXWjwMVXmm0S8j5JUk1DWCShGTe2V6u3LdA3uJXrQ:140a6DD49mm0S8jPUk1eGzdAeJrQ
- TLSH
  T1D54733E5D3ED5569E6E2E23D88A1C443E3E7B8225F15C8D3D7E042954D17AC0AA3A3C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1