Extracted

Extracted

• • Target

    Trojan-Ransom.Win32.Blocker.kxed-4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

  • Size

    1.0MB

  • MD5

    985ee7dc0de6c5081bf40ba08b93d37b

  • SHA1

    9386445adf364543c10c8f11cef54cfcd4fdd54f

  • SHA256

    4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

  • SHA512

    ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee

  • SSDEEP

    24576:gljS8/Ns4q86Oh1Jp9cAnlwDUctAaxu19GroaJqlZJhUr:x8u4q8xXTeAnEUc6CuWroaJqFhUr

  Score

  10^/10

  evasionpersistencetrojan

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Sets file execution options in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2