Extracted

• • Target

    additionallibraries.jar

  • Size

    106KB

  • MD5

    d58652cf75e6e4fcbbdbacd86dffc5f0

  • SHA1

    e33e3c4483f7db120fb7b74f192f168a2fea2000

  • SHA256

    25b893a98ec19619c227699b54a71ad99230350a01173fc7a8364fdcbe84e67b

  • SHA512

    2582e03a54137072ac896af0c2e1aabff961c552e613e00b45c8aeb674c5491ae66993eaf18ad8bce854ef0a084cb8bae41388714397b559d01768251e85590d

  • SSDEEP

    3072:z7P+SAygBvkDssqVNJk7dXJmuIYS1kTF5vsXbIBCj:nP+SsBvkuAXJdNJJCbIMj

  Score

  10^/10

  ransomwarespywarestealer

  • Renames multiple (115) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1