95126e2d03c734c5f81b350415f21e976849873c3cf549eed9f7dfdd0354b2bf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95126e2d03c734c5f81b350415f21e976849873c3cf549eed9f7dfdd0354b2bf
Size

6.2MB
Sample

221027-m4sd6sbhhl
MD5

be7402afe7aef72152011881326aa5c6
SHA1

9b1b8de0547112b27105bd39f26de18c96be929e
SHA256

95126e2d03c734c5f81b350415f21e976849873c3cf549eed9f7dfdd0354b2bf
SHA512

5605bce6529b564f5125d3e5d6eb165e0f2a7144eb1090ebc3833c977ce58b68d85e7ff8cc2cac081725897cc9224ac13c9df9b0d165eb0736b967cc173056f3
SSDEEP

49152:JqcQFTIOZeN04TTv2tyVY81DasilJoab20Maoc5+OcoP1xbaHdLHkJEZ11QAfloo:4cQUO4TbO81DaLlJoab8aocpj+DheTp+

Score

9^/10

ransomware spyware stealer

Malware Config

Targets

- Target
  
  95126e2d03c734c5f81b350415f21e976849873c3cf549eed9f7dfdd0354b2bf
- Size
  
  6.2MB
- MD5
  
  be7402afe7aef72152011881326aa5c6
- SHA1
  
  9b1b8de0547112b27105bd39f26de18c96be929e
- SHA256
  
  95126e2d03c734c5f81b350415f21e976849873c3cf549eed9f7dfdd0354b2bf
- SHA512
  
  5605bce6529b564f5125d3e5d6eb165e0f2a7144eb1090ebc3833c977ce58b68d85e7ff8cc2cac081725897cc9224ac13c9df9b0d165eb0736b967cc173056f3
- SSDEEP
  
  49152:JqcQFTIOZeN04TTv2tyVY81DasilJoab20Maoc5+OcoP1xbaHdLHkJEZ11QAfloo:4cQUO4TbO81DaLlJoab8aocpj+DheTp+
Score

9^/10

ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

ransomwarespywarestealer

behavioral2