Overview

overview

9

Static

static

1f5c5a0cae...53.exe

windows7-x64

9

1f5c5a0cae...53.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    1f5c5a0cae085b254b771ce149cb98958e66eb341586710784dfc051050e7253

  • Size

    5.7MB

  • Sample

    221027-dhfzksada3

  • MD5

    f52a0fd36a878077caa1859e9806d4ec

  • SHA1

    3e6ea7b92af7d1b14731ff301d9222c90f4db5d0

  • SHA256

    1f5c5a0cae085b254b771ce149cb98958e66eb341586710784dfc051050e7253

  • SHA512

    f60663d99c994c0e5212fa920f6c859ba5a4f18a01e63dffdd6dc6f0820d6a8200aa1040ddbcd8e2c059a3496ba10bc78913ea2029b67fb188c7cd54fdd0030f

  • SSDEEP

    98304:TNOLtQV7S8Mf6/TZHtLv58A/ocNpHnv58A9o2NM+:TNOLp8MfSzLJZhnJVD

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      1f5c5a0cae085b254b771ce149cb98958e66eb341586710784dfc051050e7253

    • Size

      5.7MB

    • MD5

      f52a0fd36a878077caa1859e9806d4ec

    • SHA1

      3e6ea7b92af7d1b14731ff301d9222c90f4db5d0

    • SHA256

      1f5c5a0cae085b254b771ce149cb98958e66eb341586710784dfc051050e7253

    • SHA512

      f60663d99c994c0e5212fa920f6c859ba5a4f18a01e63dffdd6dc6f0820d6a8200aa1040ddbcd8e2c059a3496ba10bc78913ea2029b67fb188c7cd54fdd0030f

    • SSDEEP

      98304:TNOLtQV7S8Mf6/TZHtLv58A/ocNpHnv58A9o2NM+:TNOLp8MfSzLJZhnJVD

    Score
    9/10
    ransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks