Extracted

• • Target

    BleachGap.bin

  • Size

    1001KB

  • MD5

    015bb16ddcbf8a6326ec859020466c05

  • SHA1

    f0ff1059e64175c8bf3f557cf1b0f49ed105d7d4

  • SHA256

    c1eb88cc7f7b43de1ef71fae416c729483d71fa930314c36dfb03b01b8455d31

  • SHA512

    588051f1702c69b96168c9bfa41bdb9aaffdf48bf3178e30ee1bf1510989a1b43b1032b9b002f81907428182a050befc9b00143b4991c47131bcb4b25dfc83c5

  Score

  10^/10

  evasionransomwaretrojanupxpersistence

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2