d1e77a4b84f29b4a1a78c09fdfcb9636327a24a0b5ed8bef7d51ca6daea557f3

General

Target

main.zip
Size

33.8MB
Sample

220424-qfnmvsdehl
MD5

58706ce1295deaaf0160a2adf610c116
SHA1

2b5b1cc0b3932f7ca568bdca77651ca1041dd50b
SHA256

d1e77a4b84f29b4a1a78c09fdfcb9636327a24a0b5ed8bef7d51ca6daea557f3
SHA512

a3bc76159c3e3de65e3781e6a80af663dcdef10f33ab8a355fcee574cb89473a01b0cbdad236a5d6007dcc02097d582c8556f7ea9ec72e5350897cf68a99ed9b

Score

10^/10

Malware Config

Targets

- Target
  
  main.exe
- Size
  
  33.9MB
- MD5
  
  4d3712c7e5c35bf7ec8a74b171389a4f
- SHA1
  
  8f1e5ecdafb2ca68ee48b065ecd38f6790dfef3d
- SHA256
  
  ba591d8b11be9b59dfa8fb5fdc6ba9c9e5f96db4d2be323d7a3cdf9c04f935bb
- SHA512
  
  31939f394536d8912eed9267b1b09fc65f461c25d5343b6eabeb7638749be36945dd2e907bcd6766a17a83ee285ea1e8afa86fac4fc3a6379837e12c7acf0fbd
Score

10^/10

bootkit discovery evasion exploit persistence ransomware upx
- Modifies system executable filetype association
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Sets file execution options in registry
  persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2