Extracted

Extracted

• • Target

    Amigodainapasik.exe

  • Size

    2.3MB

  • MD5

    0da0f742cf3bd80919716fbd03299189

  • SHA1

    0ff0f5254e399aa2d487dd7f0dec032a3429f257

  • SHA256

    8f8ce3e99d843a4beb1d3d961a7cab27e75e32490132464e448bdbcd97ddcfd5

  • SHA512

    ce92c93973120a2808b7b33c20324f450b1e33aa1637fd2a66bc3c8f56cd44ec492e71cd8e34eb807c6cbfc5e356332b487144168de531be787ebb75ee3778f3

  • SSDEEP

    49152:ohBJrWt7Yfg1evewmI874ZtPttM/G/jOayrdDKr:ohBJrWF04RIu4Zfa3rdOr

  Score

  10^/10

  mimicevasionpersistenceransomwaretrojan

  • Detects Mimic ransomware

  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic

  • UAC bypass

    evasiontrojan

  • Clears Windows event logs

    evasionransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (2762) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Renames multiple (5772) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Sets file execution options in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2

• • Target

    Everything.exe

  • Size

    1.7MB

  • MD5

    c44487ce1827ce26ac4699432d15b42a

  • SHA1

    8434080fad778057a50607364fee8b481f0feef8

  • SHA256

    4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

  • SHA512

    a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

  • SSDEEP

    49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH

  Score

  6^/10

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4

• • Target

    Everything32.dll

  • Size

    84KB

  • MD5

    3b03324537327811bbbaff4aafa4d75b

  • SHA1

    1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

  • SHA256

    8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

  • SHA512

    ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

  • SSDEEP

    768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ

  Score

  10^/10

  mimicpersistenceransomware

  • Detects Mimic ransomware

  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6