Extracted

• • Target

    0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b

  • Size

    473KB

  • MD5

    f10096360e1ca117a85a7e2e6e00d076

  • SHA1

    d6c2b34c10b1c7d5a86475d3b506088725e893dd

  • SHA256

    0a86d13db26c9a9ab8d5c7007f29e13c4d6622f85c1a4fb6caa7b0445276bf6b

  • SHA512

    dcf89b4748c3ed2f9040d2928987f8d26fd8c1ddbdf9be13f890aa24cdd324c46e6e7b1e8594dddcc0ce1861d4e15bd4a4dfc9928f1a0c3de3b33fe064bc91c9

  • SSDEEP

    12288:AX0VbDhm1jD/EHvjBpdBod8UvL3+R3Hsr6rY04:0KbD4VoPjvdB+7+RrW

  Score

  10^/10

  ammyyadminphobossmokeloaderbackdoorcollectionevasionpersistenceransomwarerattrojanflawedammyygurcustealer

  • Ammyy Admin

    Remote admin tool with various capabilities.

    ratammyyadmin

  • AmmyyAdmin payload

  • Detect Gurcu Stealer V3 payload

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (54) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2