6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0

General

Target
6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
Size 2.5MB
Sample240102-231rgsecg4
SHA256 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0
MD5 14e777412523173eb4dc71e384bf6f57
SHA1 69cb197a2336a58924f8f71bb65ac43e6668533a
SHA512 7251eda0171dd058435786066e31a2a054c1319e4f7e701441a4483e3edff5be4a27e5408ba413bb6e6d7919310f9f030e9d5106feccb2763e1ecb22baf02794
SSDEEP 49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
- Size 2.5MB
- SHA256 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0
- MD5 14e777412523173eb4dc71e384bf6f57
- SHA1 69cb197a2336a58924f8f71bb65ac43e6668533a
- SHA512 7251eda0171dd058435786066e31a2a054c1319e4f7e701441a4483e3edff5be4a27e5408ba413bb6e6d7919310f9f030e9d5106feccb2763e1ecb22baf02794
- SSDEEP 49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

google collection discovery evasion persistence phishing spyware stealer trojan
- Detected google phishing page
  phishing google
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2