61b4067e5ad5b238bcdfe7b5315cea3c367c248a6e0d417c7e3e600f222324a4 | Triage

Sharing

General

Target

61b4067e5ad5b238bcdfe7b5315cea3c367c248a6e0d417c7e3e600f222324a4.exe
Size

80KB
Sample

221016-h5knhaghdq
MD5

1eeb73808e0b05f9ab564a762e3587c5
SHA1

65a36c44f6483666088d22651ab022890246ade0
SHA256

61b4067e5ad5b238bcdfe7b5315cea3c367c248a6e0d417c7e3e600f222324a4
SHA512

b8fa2d102bd5e583956a99b0761847a518bd87d7a712acde886763ee954628612404436978a0cac38ae25e6981f8112b007562ee4fe41e78bb641d51fc178606
SSDEEP

1536:ra98My3ia98My3ia98My3ia98My3ia98My3ia98My3ia98My3ia98M:e98My3598My3598My3598My3598My35l

Score

9^/10

ransomware spyware stealer

Malware Config

Targets

- Target
  
  61b4067e5ad5b238bcdfe7b5315cea3c367c248a6e0d417c7e3e600f222324a4.exe
- Size
  
  80KB
- MD5
  
  1eeb73808e0b05f9ab564a762e3587c5
- SHA1
  
  65a36c44f6483666088d22651ab022890246ade0
- SHA256
  
  61b4067e5ad5b238bcdfe7b5315cea3c367c248a6e0d417c7e3e600f222324a4
- SHA512
  
  b8fa2d102bd5e583956a99b0761847a518bd87d7a712acde886763ee954628612404436978a0cac38ae25e6981f8112b007562ee4fe41e78bb641d51fc178606
- SSDEEP
  
  1536:ra98My3ia98My3ia98My3ia98My3ia98My3ia98My3ia98My3ia98M:e98My3598My3598My3598My3598My35l
Score

9^/10

ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarespywarestealer

behavioral2