aaceecc0081edc72395c7dcb36456888e92a3fb410512e3253089ff309a9b84a

General

Target
mvzdtfhb-892f18363379.exe
Size 65.9MB
Sample261102-sc2resfd89
SHA256 aaceecc0081edc72395c7dcb36456888e92a3fb410512e3253089ff309a9b84a
MD5 fb47e7ad394f68775ddb5788bf64ad93
SHA1 b1784b107b608e52d8034c80bcccd34eb264a6ac
SHA512 f36ad869ee0cc60fc5bc323fd714b718ab784fda2fec2590e0d0878e7170dd10119c3c66aa5df307ff732deddbb67f246f2b320ded5ff5263340ebb67af814f4
SSDEEP 786432:dnbJvyqrzrKQ33YC1atpxmvvjWczZ5mk8oEsSEIu/YbOxi792g1eLleMuOQzT6kB:tgqTV3taxm3jWczZ5mJlfbZH1lOJkx7
TLSH
T1D8E73312E3EADEABD6111FF604B2004B8BE57796061517FAE11E873C16A0A4FE4D9CF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mvzdtfhb-892f18363379.exe
- Size 65.9MB
- SHA256 aaceecc0081edc72395c7dcb36456888e92a3fb410512e3253089ff309a9b84a
- MD5 fb47e7ad394f68775ddb5788bf64ad93
- SHA1 b1784b107b608e52d8034c80bcccd34eb264a6ac
- SHA512 f36ad869ee0cc60fc5bc323fd714b718ab784fda2fec2590e0d0878e7170dd10119c3c66aa5df307ff732deddbb67f246f2b320ded5ff5263340ebb67af814f4
- SSDEEP 786432:dnbJvyqrzrKQ33YC1atpxmvvjWczZ5mk8oEsSEIu/YbOxi792g1eLleMuOQzT6kB:tgqTV3taxm3jWczZ5mJlfbZH1lOJkx7
- TLSH
  T1D8E73312E3EADEABD6111FF604B2004B8BE57796061517FAE11E873C16A0A4FE4D9CF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2
- Target
  ag.exe
- Size 180.0MB
- SHA256 78ceea4e850268118b900fbb3528ffcf53e52d97d91ee673f793cfd97f23bc02
- MD5 91020a29d9a398a19deab1d5369f4990
- SHA1 e6267f358ee8f0dd9b9b3cfde6aa27f9d4bca4c2
- SHA512 91a64cf9c27dbac06ced2775a08c5c3713ea1cb4b58231309711ef40d0841d7152b8bbe490675ef30459e595b111fed7f00cd27e41c41fc0728f10aeb1dc58ab
- SSDEEP 1572864:tgJz8+qNOI0zE2ya82+omc2W9Lfub4aMlRGSaHcFLDWVDoxEv+pTj6eHTW9WN6Qz:HkCUbdf19
- TLSH
  T136988C03F39A50D9E05DD1B58B479633EAB1B8854324A2DF2B5407922F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3