92161a6193eac50f5a2b9acf3d0427281ea04960a7335e1705f4cf9ab95805c5

General

Target
sample
Size 575KB
Sample240502-qagmcshe3z
SHA256 92161a6193eac50f5a2b9acf3d0427281ea04960a7335e1705f4cf9ab95805c5
MD5 aa63cbc94c5e07e269771f30339a25f4
SHA1 3e55348d2324245aa3f4a041cd427cf16350b486
SHA512 88f2ca28e005f6905856ac8d2db9d3ba71ff147ef32384884742c3ebfd982ec27483adefe3cef545515178af01d934aed606a5739301ab5147999e2b1096ce1b
SSDEEP 1536:wmANIXqTnnlwMTnnloPTnnlCPTnnlZPTnnl69Tnnll42azgmHGqP+ynMKbwHGqPH:w588xNRice77uBRice77uu
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Targets

- Target
  sample
- Size 575KB
- SHA256 92161a6193eac50f5a2b9acf3d0427281ea04960a7335e1705f4cf9ab95805c5
- MD5 aa63cbc94c5e07e269771f30339a25f4
- SHA1 3e55348d2324245aa3f4a041cd427cf16350b486
- SHA512 88f2ca28e005f6905856ac8d2db9d3ba71ff147ef32384884742c3ebfd982ec27483adefe3cef545515178af01d934aed606a5739301ab5147999e2b1096ce1b
- SSDEEP 1536:wmANIXqTnnlwMTnnloPTnnlCPTnnlZPTnnl69Tnnll42azgmHGqP+ynMKbwHGqPH:w588xNRice77uBRice77uu
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

adware discovery evasion persistence ransomware stealer trojan
- Renames multiple (125) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1