Extracted

Extracted

• • Target

    3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370

  • Size

    284KB

  • MD5

    209a288c68207d57e0ce6e60ebf60729

  • SHA1

    e654d39cd13414b5151e8cf0d8f5b166dddd45cb

  • SHA256

    3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370

  • SHA512

    ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3

  • SSDEEP

    3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui

  Score

  9^/10

  persistenceransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (696) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    51B4EF5DC9D26B7A26E214CEE90598631E2EAA67

  • Size

    257KB

  • MD5

    6e080aa085293bb9fbdcc9015337d309

  • SHA1

    51b4ef5dc9d26b7a26e214cee90598631e2eaa67

  • SHA256

    9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122

  • SHA512

    4e173fb5287c7ea8ff116099ec1a0599b37f743f8b798368319b5960af38e742124223dfd209457665b701e9efc6e76071fa2513322b232ac50ddad21fcebe77

  • SSDEEP

    6144:xy+als+0nIycigV5cbEo6dZbBODPIsjQ/UFsYW:xy+aCFnIycigVSbObBODTMUd

  Score

  10^/10

  persistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (355) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    E906FA3D51E86A61741B3499145A114E9BFB7C56

  • Size

    261KB

  • MD5

    6d3d62a4cff19b4f2cc7ce9027c33be8

  • SHA1

    e906fa3d51e86a61741b3499145a114e9bfb7c56

  • SHA256

    afaba2400552c7032a5c4c6e6151df374d0e98dc67204066281e30e6699dbd18

  • SHA512

    973643639cb02491b86d5b264ee8118a67d8a83453307aea95de2f4c6aa55819d37730c41dc3338116ebe86f9a4f2bba7d9537ea744ae08b9755f05c15153fad

  • SSDEEP

    6144:93g0BQG+aZiycigV5bbEo6dZbBODPIsjQ/UFsYWo:93g0OGjZiycigVRbObBODTMUdj

  Score

  10^/10

  persistenceransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Renames multiple (368) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral5behavioral6