phobos

Sharing

Copy URL Twitter E-mail

General

Target
samples3.zip
Size 1.5MB
Sample240101-sv2t5sdbdr
SHA256 b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2
MD5 c03fcbff1eb9c1f121a8b49e9c89fd32
SHA1 327c876c64bd3046e1ac9a16f246d13ca06b8a09
SHA512 98aab9ff1965d0f41738241189878132cdb7e2035b974ff7a79f424320935760c0ceb18d40b019a3d55c4961b172a0c793ac5129525755ebfca079a063c8e6ff
SSDEEP 24576:WEJ3zt4o+oLXY8KefDWjAGu8km5vnx42IZjJhZhCD97aWMKIMKFrE:fzzjKerHivnx/IZjJ67aWZIMaE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>phobos</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>6ED41006-1130</span></div> <div class='bold'>In case of no answer in 24 hours write us to this e-mail:<span class='mark'>[email protected]</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> <div class='footer'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAH4AAAAUCAQAAADhRUE/AAADW0lEQVR4Ad3WA4wnZxjA4efWZ1u1bdu2bdu2bdu2bUS127PN9TQ9TObLdP4zNb5fcLf75s0+yQiIcnpcDXaK/3+38NDFwb4XiRwLoMrZmjJ3NtkKd4pKNszikqeXl0tM/6Q3gEV8WnLzsxTDj7dmSXy1uzWIAnylo00R5eNzOl98dPeg5kL4+bxZcutkO8T43O5TZsdMfGvviQJ8pWNMFf0J+AEWjOkPZc8F+Pm8lTP5lDbF8ROsaruC+Hx6gM/tgnx6gM+nT7UJQrwGQw2c0QDDwgvMNXYujN8xoE80MG6ohgz8mHhmgOmiRN/op8yNorhmIxM7RyfwvbTxXGKy0TADwwzxgNZp/BDL66OfvuZ2U4D/0Zp2KIw/VZTYufUvO2fUx3IGZ+AP13PGTG97GieKm+501WqCe/h1S8Y7e9lfUwLf3feJq+tuc+kZppcOpPED9AFVTjE9uJzWJXHPv2LdoE19kYEfajPJ08dPGfhdAGv5XhRXO4NOywT+DfNInq0z8d/a2VrWSbWuZZX/Or7aqWl68LRvUhdUrzkDfxG/Cb+2H9L0AF9rfQriG9SqS6fJ69pI41Vm0GN8TiH+jN+EX9OPwQV/mmpCvGlWycfn9k4a/5O5Uxf8evxt+BODTYMty9+H/9EaPkvR/z58BzcH34QfWfTvww/Q34IuMnjW/xL0AD/Mi16Ke9ErxhfEL25ECTwd3JLi5+EPEiXwHdzhZS+FhX9lFr4PyizsPK/YgAz8vaoSVerg/UL4ubwiKomnnRs0hvyS+I0MCj9yVChLp9KBJuXjoYXWyjLxxd/zt1reSrNaO0GPNNg8wJ85a3IFG/k4vET1UB3jax0Y71zBLgYmJr/XC60sZ6UwKzg8+Hp4Q+tsPPgT8PWmxk0LPpse1S3A18ZzU9QG+Ne0Dz5ypid21iXmpjleBbY0ztRU9YnJMXbmr8Zn96geBPisam0fXPZZTXOCSuLP2+zG2FWLfw7/mJ4UxL+ifTY+oFeBLUzLoe+WpP9W/HCHF8Xn0PPxtXYgFz/NibPobb342+icO6PzHKt9SXyzoa6wmDLhqbK/82fsON+qWHPW/9Kd5wS9xMc2LnBuZuc7QltQaV/nZ07toRrQwynOK7FvC2V+11nHJZZV7n9zfgbFAebsYO1DaQAAAABJRU5ErkJggg==' /> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>
class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Targets

- Target
  samples3.zip
- Size 1.5MB
- SHA256 b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2
- MD5 c03fcbff1eb9c1f121a8b49e9c89fd32
- SHA1 327c876c64bd3046e1ac9a16f246d13ca06b8a09
- SHA512 98aab9ff1965d0f41738241189878132cdb7e2035b974ff7a79f424320935760c0ceb18d40b019a3d55c4961b172a0c793ac5129525755ebfca079a063c8e6ff
- SSDEEP 24576:WEJ3zt4o+oLXY8KefDWjAGu8km5vnx42IZjJhZhCD97aWMKIMKFrE:fzzjKerHivnx/IZjJ67aWZIMaE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3
- Size 96KB
- SHA256 05cf6eee9b0b2c049cec8ce775de0636ade55f23a51dc833170f09445719abb3
- MD5 4bf4c29c3df1965b88cbbbd80f9706e1
- SHA1 8c9a4a9c70aca458f8e69ec810956795f64fc519
- SHA512 8c77048296c30a333a890762b7480c9c13cbe621e766408021f8b30d794e61abde942549720fe486690962494282a2bbd2d1ad205cfe180047bed5bf7d2657b4
- SSDEEP 1536:oNmzHAF+PuOwZ01Bh1HcRAI92PeCKrrqdsicjgzqSkhrGK7YMUV3P:ozX+1Bs2PaOKicjQYrRDA/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7
- Size 92KB
- SHA256 0d332c04780976b3cf6d505b5d7060c2f40399f581a8629885ad086e967f68a7
- MD5 6c482e3d0fdc8af0182d543371ca5176
- SHA1 e4de59423b77477cc593b7f31d08252107444524
- SHA512 ed217f7c2a0b0ca7716c0c04dc369598371d997590437f70ce68147276ef0cc8e3539306abcd5d16266dc5d4a6b984eab9e8fc5348dc2f6607ddea3eed4e0411
- SSDEEP 1536:ReybNDac/BiUkGgxjDUsFFtZjSrHOUTS6r17Y4HbmxwRwW:lNDgUm5Fi6Uu6r17p7zV
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

persistence ransomware spyware stealer
- Renames multiple (9950) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral5 behavioral6
- Target
  0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e
- Size 158KB
- SHA256 0fd8500fdef116abae01a1dcfed2db9784bbcb753488710aa1048f2aa0fd111e
- MD5 f8a89c8681173db7366fee4a3147b0cf
- SHA1 9f7a8a330e6f493e995d1623f3ff987cf89bba4a
- SHA512 4c1171a22522b4d3abcc733ad95ff45cf0935eff5fb34935b64fb3d2f519dadeca1576b2833b0f7dee929803e77e0c5ca6896c79d91a5c96272f6e8e90e8489b
- SSDEEP 3072:LEbo5Dei1JEo+eip7trJ7c+BaqhSVbKEIvZJqhWSpIBiih1:LMoQlohixtrJzBaBJKLOhEQih
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed
- Size 184KB
- SHA256 11edf9436a9205c88c2a815cf6ebfb0a7a42eb150a2649766b3bb30350ee35ed
- MD5 88bca052a833461e2dd2b3170fff76c0
- SHA1 1304478347bd7f47b84cd39ffc545ac1f55707c1
- SHA512 098639ca995bcc33b1a309c3add6a60b9ab69e527dedf7005ac0c8dcc21e30070460bc7fec4b73ede0cd475244c03a6fad527f4732bb3dd559a5f9a0e34526c6
- SSDEEP 3072:XT8Q2YM+ti7mMzJ5HQOEzsTKshIK7Yw31MXM2fbGBeaIIadcXnMFGoF:j8epiyiwl01MTc2jGQjZdc6GoF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c
- Size 145KB
- SHA256 19a640415bb2bbc2f2624c204f6c5771b908b6c54b88976eb0daa76a29af255c
- MD5 fd946ba0ca811f8f5cddba5c4634fd64
- SHA1 02536e5089857fd7421a50adb07fe871593d5b9f
- SHA512 b50b8bbd93bf00e9d89cadc99900211d5b7a3d3e0f5d450445435ea498ee58be80151f608912244f55e9ad2f907fa896f66389d987b8d3b1a470ad257d7414e8
- SSDEEP 3072:Tv/FR9m6kfHpVC1pY8iblkCIax6CdAje+QlLC+Q/eJRhz8Jmu+X:j/f9m6g42xqQVSD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral11 behavioral12
- Target
  33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb
- Size 46KB
- SHA256 33aa57b04bbdcf9617ed334dda4aee9502be652771899c75937f0e1223c7e2cb
- MD5 8bcffc24d7a50cdff0c52c46a7a124fa
- SHA1 f6e439f1503c727deb6d2a5d09b4a455728a0217
- SHA512 e87023b4f56852a9f8f340f8476dc2d91d1216845816fcf74fe561b625de18628b9f3e1fe21236b20066dd83838d6d6ea4338424a89b998c7e82edf6e829fb2c
- SSDEEP 768:7HQRmGZ1BcDZzEdjRBeV6rgd7Ai4XqobtXg6aKlnRSc:7dGO6ddBesrgd0iuq2tXg6hlh
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral13 behavioral14
- Target
  3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19
- Size 187KB
- SHA256 3643464a225aa2ad5c9c9657d4fd05b943fdd9c04ca36b9d3610a04332909d19
- MD5 5239186df089b14d776b1438bc495878
- SHA1 40a0689b89576ce865f3b5eddb18acb679219704
- SHA512 eb235607d70e70cc5eea1102582b599ec483aee5b8fdb8dd6524952230746bfefa5316bf31c78eee43e9d61bd6736cc973f8c45cbd175ae93bc960f10cb2a3da
- SSDEEP 1536:giTQB4GEf+C6P7Pr/yIcavDI47BHs7E5FGcAfKYelzgvf5nBbN+JRiHZ/niduyZx:g3B4/WC6P77yIlJdR20UBY5duyKp5c
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526
- Size 48KB
- SHA256 37e2f977559a58cb33f7128ad7699a5c4f7c0013d8d83b1eda93a59ae35ba526
- MD5 13a5784e5e7429fc4b5bfca4adb68496
- SHA1 612bd66c936396b789dcd2ff2132932b7d411d2a
- SHA512 cb1e4aae816b510877806d71a6c594f9beecc73b7043de9230233a22cc63dfd07ffde46b7b0ca0ab617dbbaf4cb29cd3e1643672ba18eaa65b825f223b8412f8
- SSDEEP 768:3oyDyGQf9/NCbfdgqSlDrJ4UQwxqj4HitVdXPT8B6u5PYuFm:3XQ9/8RhkO5j4HwXfT85PYGm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff
- Size 163KB
- SHA256 54cd11236fdc2a40b505598541f64e8a6bd9ea84552b6d5946777badf8a2b7ff
- MD5 f435c9ea441e60844f6cd74a3d7510c1
- SHA1 8cf5e06091086822efea0e6e1d3acdaee6c56f95
- SHA512 c529064ec99ead01fa97ba0e309cbf5c8d263a3537605115a884e888a2ef1865691216eb96c8f6ca023d41ec74041cc9128dacca51e2d9585e7e10e6eb914e6c
- SSDEEP 3072:00tTiVVFj3dTcAskPC+G4+6mIc4RmwE4j2lmm4c+JttZOKih7bDHLLbD:0VVLTnq+upI5Rmww/GtZObvbD
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20
- Target
  55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c
- Size 63KB
- SHA256 55bc661ad4439400fc434fd6bab66f598c7272854f0453b451e31b84265eff8c
- MD5 8631a8f38c49a008fa27a1206378e144
- SHA1 b13d05d99b91fdff5802660218d26c4811e062a0
- SHA512 989e642115b8453e5b806e70914243f728d38d29493cb75b49981dd390ad155502b2998bb435ec8f9e88ef0a4ca8921fd7a54f5685c4aef5167ee1a0ea16dee0
- SSDEEP 768:FWSro9/JJCAaXRCZ+W8UVVMKccxkujVuIbRr4R9FF2GRz:4SE/Db0a+8BccxcIbV4zxz
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

ransomware spyware stealer
- Renames multiple (52) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral21 behavioral22
- Target
  603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568
- Size 45KB
- SHA256 603d665f09a9a199a4b5b9f8d1841a07ae9c525f275fc54c7cb15953d73ff568
- MD5 a0c64acfd1267947bc76ff8e44d0bd7c
- SHA1 83d882a0ef6536d2bcb19e6754b5c3364c1f4459
- SHA512 822dbc0fb22217d693a717a52aa73627ad076a2fd808f1730639dc86324e02a20b1cc740cdec495ea2f55585d10de84a05ea68b66e42f6200fad99d807160d74
- SSDEEP 768:Z8Tonah98DUrTu+VxRtR3JKgVdXPauv1yzblwBG:Z8IA98I++bLR3BXfl1yXyc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e
- Size 58KB
- SHA256 6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e
- MD5 c41858fceca5148ce899e350bf6b2651
- SHA1 9a9961d05631c8345a1b8b9ea0b95063d946fb8e
- SHA512 2ecf0cf9753b521f1393a62d4d411e99924620086e315164ec1f30f30353eb99eaecfc610553e66bcecb091109e979798d5057db925c21263f74da7d7135a2d5
- SSDEEP 768:xilH4hDEJbQpg4R+QokagvBexAb5BMX+nXVoVq3QXNTrsjTZD+UknIzyv3n6Ul4u:YqJEpeg4RXoMsu5tK90jTbknIsFo6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c
- Size 125KB
- SHA256 73af283fcb06a9ea35ea6ad24b62b302459594f4b09dbba2d74001bf90ab020c
- MD5 989d0f34c3f5e1688071cc058e49f6cf
- SHA1 d57d9bc46d6a0228cde494d843becdadbf070d7d
- SHA512 83949f0d0cf5b22ea48d4098ca430edcdc857ef0abf2ab45e7b8feffd906a351991af100bc94ad829155375ff2426d7364084da29c63e89d7e3c10a67d44747a
- SSDEEP 3072:RwNZx8JGA9ZDsjHl+lIvPpKKvq9aqBJLxFfVK9Y:SgnsjF15x/CJLfM9
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion
- Disables Task Manager via registry modification
  evasion
behavioral27 behavioral28
- Target
  7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667
- Size 153KB
- SHA256 7e41197b74e2dcc6c0563d4b71a4ad16293909889ce4f1c5ab214bdd59088667
- MD5 91e890f3e0f1f456486445816797a221
- SHA1 244741c1514206d953d5d4767fd0c3dd48cfc6d7
- SHA512 c91287ea947bc43a7c1d54028e487e8df88b4cbce07e0c607fa35d6849189b4f2efb472b1cc80bc2668ff7e9553d28e852a021c8cccd551ecb3d6b1db0e36f5d
- SSDEEP 768:oS+1pDY5Kp+ByAAAAAAAAAAAAAAAAAAAAzAAAAAAAAAAAAAAAHtAAAAAAAAAAAA3:b+1pc0sB5QV0TGE
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

ransomware spyware stealer
- Renames multiple (66) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral29 behavioral30
- Target
  a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99
- Size 185KB
- SHA256 a878fed05519b4e0898e26a79cc646c0bb7b9e380c94f06baecc750f0ab97b99
- MD5 f1dd63587760176e8a57c378ed2113c1
- SHA1 21ad96148b4f65bad4d7f28fb422a112c19e9b18
- SHA512 9bbafa10779f2d1eb210254d48f2df62cc40fa6445b7a1a6b2d24a485e036098025c0d8cd39524b7fb496f53e31b49f3c0783cf0718e65c99e42685e9379b6ad
- SSDEEP 3072:lVnUZh5lgIS4YU3KEvOnEVV5KbHyM+lmsolAIrRuw+mqv9j1MWLQLmbY:lVU35lvS4YiWnEVV0bR+lDAAVb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32