Extracted

• • Target

    sample

  • Size

    7.8MB

  • MD5

    f823e7fcc3dcc9bfacbd649ead857d15

  • SHA1

    9a46483ade0f43b6d1aed2fd259a255bd4daa1f3

  • SHA256

    c97862eb9d56f566352cfc548542770d414edc375c3a0b767597cd6d1f47845b

  • SHA512

    d74e988cdc2122c05448017581a7274b2ed0abfdcf7ded1dac8ecaa20e9c1af0c2012516aaf54fc4d6809c75b6cbf46eaadb6c49367a74b68169526ae3efc8ac

  • SSDEEP

    98304:d+v9K8MgmB4oIWcCJ3ZZVL8oYi5lTkZkmla1DXL:y4uWcCT9Gzl

  Score

  10^/10

  ransomwarespywarestealer

  • Renames multiple (880) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2