0f5a9c3a31d7cfe83073beb2405b53e12784c76028fb63fd163ba8d5b0ca652c | Triage

Sharing

General

Target

0f5a9c3a31d7cfe83073beb2405b53e12784c76028fb63fd163ba8d5b0ca652c
Size

1.0MB
Sample

221026-hlhpssehe5
MD5

36eaccb190d758dd5c0419ca8448678c
SHA1

f01341319f73f2cd965d93874bf06273777fb3df
SHA256

0f5a9c3a31d7cfe83073beb2405b53e12784c76028fb63fd163ba8d5b0ca652c
SHA512

d9062b3acdff4acc319156976147e5c2560cc5383a8aa9f268c3c81e5c31519836cd4072a50d87e37950d03bc96ae2c4a37f3e07acd5490d24cc852e68a229f2
SSDEEP

12288:lKKKGdzswxeqWiZU6zQC4x0Ov9lHMswaLQ0xJNbL5wITnU5KI0zpWdp:lKKKGdzswxeqWiZUCM2OLmoQKXIgzodp

Score

9^/10

ransomware spyware stealer

Malware Config

Targets

- Target
  
  0f5a9c3a31d7cfe83073beb2405b53e12784c76028fb63fd163ba8d5b0ca652c
- Size
  
  1.0MB
- MD5
  
  36eaccb190d758dd5c0419ca8448678c
- SHA1
  
  f01341319f73f2cd965d93874bf06273777fb3df
- SHA256
  
  0f5a9c3a31d7cfe83073beb2405b53e12784c76028fb63fd163ba8d5b0ca652c
- SHA512
  
  d9062b3acdff4acc319156976147e5c2560cc5383a8aa9f268c3c81e5c31519836cd4072a50d87e37950d03bc96ae2c4a37f3e07acd5490d24cc852e68a229f2
- SSDEEP
  
  12288:lKKKGdzswxeqWiZU6zQC4x0Ov9lHMswaLQ0xJNbL5wITnU5KI0zpWdp:lKKKGdzswxeqWiZUCM2OLmoQKXIgzodp
Score

9^/10

ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarespywarestealer

behavioral2