3a110b2b086cb1543b1f0c77e8f49f0f4e76f60e78eead449aa5a93fb4f86979

General

Target
mvzex4zk-ea1ad96ed56f.exe
Size 66.0MB
Sample261102-sx4rhsa15z
SHA256 3a110b2b086cb1543b1f0c77e8f49f0f4e76f60e78eead449aa5a93fb4f86979
MD5 52958a5be21fcfa3e2428fc4591ccf64
SHA1 d105e281f3aebc733d704c05655a0d2764d0ca9f
SHA512 783cab597ffb1062af15fbbacce036df28b40a4a0e1bd72a2350fa13619e53113b870f01efed5eafef6dff2980e83f0725e7802bae8100f756a44f6940d619a3
SSDEEP 1572864:WgqTV3taxm3jWczZ5mJlfbewNaIAmzkP7:WTV3tagj1zZ5mJBxNZAqS7
TLSH
T154E73313F2EACE1FD4A57BFA54AB00078FC56743162653F9E11E426D2890A4FF899CB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mvzex4zk-ea1ad96ed56f.exe
- Size 66.0MB
- SHA256 3a110b2b086cb1543b1f0c77e8f49f0f4e76f60e78eead449aa5a93fb4f86979
- MD5 52958a5be21fcfa3e2428fc4591ccf64
- SHA1 d105e281f3aebc733d704c05655a0d2764d0ca9f
- SHA512 783cab597ffb1062af15fbbacce036df28b40a4a0e1bd72a2350fa13619e53113b870f01efed5eafef6dff2980e83f0725e7802bae8100f756a44f6940d619a3
- SSDEEP 1572864:WgqTV3taxm3jWczZ5mJlfbewNaIAmzkP7:WTV3tagj1zZ5mJBxNZAqS7
- TLSH
  T154E73313F2EACE1FD4A57BFA54AB00078FC56743162653F9E11E426D2890A4FF899CB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2
- Target
  asd.exe
- Size 180.0MB
- SHA256 91698d3deb2bd8383d9d7d57df16e163c307a8cbd5889ee0777f636252345189
- MD5 c0017acadfc4be4f05d5afe7b2028d85
- SHA1 bffe9b72610c9edc1a366895c868ba2f0b5f6c4b
- SHA512 46eca13fd951ec8522425017693a1052bd061bfa7dadc5ffb49691c6187cfb72a07cda4b713aabeaf7eb633d4b154a181930eeb3a933926c6383003be0495b38
- SSDEEP 1572864:tgJz8+qNOI0zE2ya82+omc2W9Lfub4aMlRGSaHcFLDWVDoxEv+pTj6eHTW9WN6Qz:HkCUbdf19
- TLSH
  T142988C03F39A50D9E05DD1B58B479633EAB1B8854324A2DF2B5407922F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3