General
- Target 409839f9c8327eff6208aeca4f7113f5a0abdfa97f266f404b14f9fa6ab1432f
- Size 346KB
- Sample220130-snxxlsdfh6
- SHA256 409839f9c8327eff6208aeca4f7113f5a0abdfa97f266f404b14f9fa6ab1432f
Score
10/10
Malware Config
Targets
-
- Target 409839f9c8327eff6208aeca4f7113f5a0abdfa97f266f404b14f9fa6ab1432f
- Size 346KB
- SHA256 409839f9c8327eff6208aeca4f7113f5a0abdfa97f266f404b14f9fa6ab1432f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory