Overview

overview

9

Static

static

3

3a65960985...23.exe

windows7-x64

9

3a65960985...23.exe

windows10-2004-x64

9

Resubmissions

23/02/2024, 23:29

240223-3gn18scd5w 9

23/02/2024, 22:31

240223-2fh8xsae24 9

22/02/2024, 14:24

240222-rqwlwsbd65 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623

  • Size

    4.5MB

  • Sample

    240223-3gn18scd5w

  • MD5

    fe025d0f649ab10b399efd628fa8df3e

  • SHA1

    30a824aa97b286e0088b9191ce47e547c1120921

  • SHA256

    3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623

  • SHA512

    47cdd4e41bbf00366347dcfb01e4693a21514a0be0b96a782eddca175b8f2a9d77bf2461929a4620677e59c729bbe20668cf1ea5a4df0b20b7a5acc5540e25ba

  • SSDEEP

    98304:Ov2Ppnz/doAD1FWM9MSq7QPYR/LeouroTfzYSzcNXH33pQBswnmB:pRnjdoATaSqkPsyvroTfzYmcNH3pIU

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623

    • Size

      4.5MB

    • MD5

      fe025d0f649ab10b399efd628fa8df3e

    • SHA1

      30a824aa97b286e0088b9191ce47e547c1120921

    • SHA256

      3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623

    • SHA512

      47cdd4e41bbf00366347dcfb01e4693a21514a0be0b96a782eddca175b8f2a9d77bf2461929a4620677e59c729bbe20668cf1ea5a4df0b20b7a5acc5540e25ba

    • SSDEEP

      98304:Ov2Ppnz/doAD1FWM9MSq7QPYR/LeouroTfzYSzcNXH33pQBswnmB:pRnjdoATaSqkPsyvroTfzYmcNH3pIU

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (309) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks