58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d

General

Target
b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics
Size 236KB
Sample240513-mf7tysbb89
SHA256 58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
MD5 b2739b7f6d1227761aefa9f256ed9970
SHA1 9c3868075147e7815c13008b8e837a387387fa05
SHA512 cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
SSDEEP 1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b2739b7f6d1227761aefa9f256ed9970_NeikiAnalytics
- Size 236KB
- SHA256 58676e386e9d85c29873f52a803cfff142d56820c9213ccf16c9de0170ace24d
- MD5 b2739b7f6d1227761aefa9f256ed9970
- SHA1 9c3868075147e7815c13008b8e837a387387fa05
- SHA512 cb9beebf23cad6e45c83de7251dd3bc5f655e0b69ba22d4d5041c0541ad873d3d05a5c279a14452cb0f543f27f32cec34986128c4a37bdaba5bf2c9476c152a5
- SSDEEP 1536:WDusHJo0IHgL2AHfb1mzaFXg+xsukl4Y17jsgS/jHagQNuXGpeV1eT92NdTy2OBn:1ox6AHjYzaFXg+w17jsgS/jHagQg1E5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion persistence ransomware trojan upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Drops file in Drivers directory
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2