Extracted

• • Target
    3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e
  • Size 319KB
  • SHA256 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e
  • MD5 37db790ae1c5c9d514f0b21b2ee41eba
  • SHA1 b82c08f43f11430773d313ee362ca0726bbafa24
  • SHA512 79c8cfad6f27739cd567d2f49035ab37081d38677e9b0ac28942d4221a4327c9f44fc3deb31038543710d533369681c8a82561b97008e33dc6e3d5e5f2937c0f
  • SSDEEP 6144:fMjokASLOMN9/wJP96/0ma0ZlDFWs9zAnmeDWB2hDukzinSiikKWfxCdvHnQSd2b:nkAqOi94x968mR/DDzBO82hpinSiikxp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  crypvaultponycollectiondiscoveryevasionransomwareratspywarestealer

  • CrypVault

    Ransomware family which makes encrypted files look like they have been quarantined by AV.

    ransomwarecrypvault

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2