General
-
Target
95C8.exe
-
Size
684KB
-
Sample
210213-ks2y52s7x6
-
MD5
7efdbcd2dda98974f89290ce0a02cdc7
-
SHA1
cbae61ac09fe75b570bee392aa70310ef4d94362
-
SHA256
eb8de87523800e3aa747857a06938f3af3856fbd42be025688e2ff50248ac197
-
SHA512
b9d334d10bc4c02007efcdd789a4fb91bffa3790c8d8357f438cd167c86097acc0b6d4889c1b81de77c42e8b7d5f04f3a8dffca80adc2a9148051b68d1215adc
Malware Config
Targets
-
-
Target
95C8.exe
-
Size
684KB
-
MD5
7efdbcd2dda98974f89290ce0a02cdc7
-
SHA1
cbae61ac09fe75b570bee392aa70310ef4d94362
-
SHA256
eb8de87523800e3aa747857a06938f3af3856fbd42be025688e2ff50248ac197
-
SHA512
b9d334d10bc4c02007efcdd789a4fb91bffa3790c8d8357f438cd167c86097acc0b6d4889c1b81de77c42e8b7d5f04f3a8dffca80adc2a9148051b68d1215adc
Score10/10-
Deletes Windows Defender Definitions
Uses mpcmdrun utility to delete all AV definitions.
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Taurus Stealer
Taurus is an infostealer first seen in June 2020.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-