Extracted

• • Target

    950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e

  • Size

    30KB

  • MD5

    ed0413e7e8a4280fe74f5afb87054b52

  • SHA1

    92f8eca9aaad091ed525d52565932843097cc36e

  • SHA256

    950be5b5501ee84b1641c3a9a780242a57cdd412892c781eac8781498bf11f3e

  • SHA512

    55ccdcb90e556c83afdfcd1fb2106518d35c719ff199f8430377293a297223e14cccdc29add9b3c9b08221f9268f55d56f0ca17ab21cb898a9a1224daea6c8c4

  Score

  10^/10

  t1happyevasionpersistenceransomwarespywarestealertrojan

  • T1Happy

    T1Happy ransomware is a cryptovirus that behaves different than its counterparts.

    trojanransomwaret1happy

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Disables RegEdit via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2