dc1725015e18e586613feed7f94457a14b40c1e3ca87d78543a38f3ab58dfde5

General

Target

Trojan-Ransom.Win32.Blocker.ivbx-dc1725015e18e586613feed7f94457a14b40c1e3ca87d78543a38f3ab58dfde5
Size

862KB
Sample

221107-ez8atsahbl
MD5

69d4343e34285f48ed7d1b02609b6423
SHA1

f55b274b8451ef2a943020bb86f6774faa3cd116
SHA256

dc1725015e18e586613feed7f94457a14b40c1e3ca87d78543a38f3ab58dfde5
SHA512

cfa6af282cba559fdf0cff95e80c17ef5f8306f1e8dc94aaa693cb05047a83a47d0b4ce3960a76d798349d77fb3f6e93455c998e41c6c41e6f3ea70ba8f6e7f9
SSDEEP

1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score

10^/10

Malware Config

Targets

- Target
  
  Trojan-Ransom.Win32.Blocker.ivbx-dc1725015e18e586613feed7f94457a14b40c1e3ca87d78543a38f3ab58dfde5
- Size
  
  862KB
- MD5
  
  69d4343e34285f48ed7d1b02609b6423
- SHA1
  
  f55b274b8451ef2a943020bb86f6774faa3cd116
- SHA256
  
  dc1725015e18e586613feed7f94457a14b40c1e3ca87d78543a38f3ab58dfde5
- SHA512
  
  cfa6af282cba559fdf0cff95e80c17ef5f8306f1e8dc94aaa693cb05047a83a47d0b4ce3960a76d798349d77fb3f6e93455c998e41c6c41e6f3ea70ba8f6e7f9
- SSDEEP
  
  1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2