Extracted

• • Target

    LB3.exe

  • Size

    146KB

  • MD5

    567371a071752719b9890da555dccb9a

  • SHA1

    4e076a6c2a213f5efc197cdd9e08d8362c24f456

  • SHA256

    169da58a5e57c6a68c1b9c07061b70e6c60d23f1708821a091d6f41907b0e9d7

  • SHA512

    08081a7a8dbf3434088c9fc51506e078db95abf8cf4797a279f5145d6658c970be896b4adcb25e40d2ecc115e2b11e0d7a688fbd34be98a4d8e62f83cf361e8a

  • SSDEEP

    3072:C6glyuxE4GsUPnliByocWepW5nVTbXaiMI9iyVD4cr:C6gDBGpvEByocWegn1Jlr4

  Score

  10^/10

  ransomwarespywarestealer

  • Renames multiple (809) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3behavioral4