090534c590806d6b15e0fe0d0b40e8c93a7e070e49d4a93ee2060a665482a8ec

General

Target
eecfcb1c00518594[1].exe
Size 67.6MB
Sample261101-vcc46sby2w
SHA256 090534c590806d6b15e0fe0d0b40e8c93a7e070e49d4a93ee2060a665482a8ec
MD5 ef69e9ed9b23c956038e62b243cb514a
SHA1 1b4c8d9134c78d48577a82096111d7793d441d0b
SHA512 f9b4a4d0dbcdeeb9d01b8c46d8f4b23aef56d4dbfb861fa6b5addfb413e9736c24f69560f686fdca56ab52c331c46cab615ead77d63b4ed39792b7bbf018f249
SSDEEP 1572864:1M16ybhZG7rznDSgbMZsmNrQZ9v9eEL83rMPeqT14SaRYomZ:1M1fWbDShsoELarMmq5/sYJ
TLSH
T126F73368A5821CADC499803BBD1536E077EE3CEF128411E253BEF1565C37B85AEAF04D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  eecfcb1c00518594[1].exe
- Size 67.6MB
- SHA256 090534c590806d6b15e0fe0d0b40e8c93a7e070e49d4a93ee2060a665482a8ec
- MD5 ef69e9ed9b23c956038e62b243cb514a
- SHA1 1b4c8d9134c78d48577a82096111d7793d441d0b
- SHA512 f9b4a4d0dbcdeeb9d01b8c46d8f4b23aef56d4dbfb861fa6b5addfb413e9736c24f69560f686fdca56ab52c331c46cab615ead77d63b4ed39792b7bbf018f249
- SSDEEP 1572864:1M16ybhZG7rznDSgbMZsmNrQZ9v9eEL83rMPeqT14SaRYomZ:1M1fWbDShsoELarMmq5/sYJ
- TLSH
  T126F73368A5821CADC499803BBD1536E077EE3CEF128411E253BEF1565C37B85AEAF04D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence spyware stealer
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1