Overview

overview

9

Static

static

3

1fd07b8d17...43.exe

windows7-x64

9

1fd07b8d17...43.exe

windows10-2004-x64

9

Resubmissions

22/05/2023, 07:40

230522-jhz1cahf3v 9

24/10/2022, 07:48

221024-jndz3afdhn 8

Sharing

Copy URL Twitter E-mail

General

  • Target

    1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43

  • Size

    2.0MB

  • Sample

    230522-jhz1cahf3v

  • MD5

    08e76dd242e64bb31aec09db8464b28f

  • SHA1

    3f3f62c33030cfd64dba2d4ecb1634a9042ba292

  • SHA256

    1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43

  • SHA512

    2aaac092a07e7238e73f7ed02243500de6f0c34182ab894eb6adb4364212b852301191c866dffa3450b8f795217b3f649b8eda91e604f5784523b7c22efbcaa8

  • SSDEEP

    49152:8ddZj/Jrb/TyvO90dL3BmAFd4A64nsfJ7j7TPtGzd4RgLj2Dau/oZz/Fz1/:8dHj7KBg5ov

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43

    • Size

      2.0MB

    • MD5

      08e76dd242e64bb31aec09db8464b28f

    • SHA1

      3f3f62c33030cfd64dba2d4ecb1634a9042ba292

    • SHA256

      1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43

    • SHA512

      2aaac092a07e7238e73f7ed02243500de6f0c34182ab894eb6adb4364212b852301191c866dffa3450b8f795217b3f649b8eda91e604f5784523b7c22efbcaa8

    • SSDEEP

      49152:8ddZj/Jrb/TyvO90dL3BmAFd4A64nsfJ7j7TPtGzd4RgLj2Dau/oZz/Fz1/:8dHj7KBg5ov

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (7498) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (7798) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks