infinitylock | 423635cb4c0718c35315580965c2c3b8fe7cdb964b8dad8fbed0c68f26d3e18a

General

Target

Screenshot 2024-04-10 213505.png
Size

33KB
Sample

240719-e15w4awbrh
MD5

5b8fd1fb516ac6ab43d54a0aef15dc90
SHA1

ecd4a58c4327dea884684e4c2e7e30cbc356b047
SHA256

423635cb4c0718c35315580965c2c3b8fe7cdb964b8dad8fbed0c68f26d3e18a
SHA512

1eb11c4529939dbec28a1edbb2d1978220e25485149efe30d3d84b8700622ac87e6b77b45ef393efd73ccea59d2a1d99972b411c53d608737fa28d01391892aa
SSDEEP

768:QXj18TlTmFWHSehHo0zurN3JLxb2bEgW8RqU:+jmxThRo0irN1xSb9WuqU

Score

10^/10

Malware Config

Targets

- Target
  
  Screenshot 2024-04-10 213505.png
- Size
  
  33KB
- MD5
  
  5b8fd1fb516ac6ab43d54a0aef15dc90
- SHA1
  
  ecd4a58c4327dea884684e4c2e7e30cbc356b047
- SHA256
  
  423635cb4c0718c35315580965c2c3b8fe7cdb964b8dad8fbed0c68f26d3e18a
- SHA512
  
  1eb11c4529939dbec28a1edbb2d1978220e25485149efe30d3d84b8700622ac87e6b77b45ef393efd73ccea59d2a1d99972b411c53d608737fa28d01391892aa
- SSDEEP
  
  768:QXj18TlTmFWHSehHo0zurN3JLxb2bEgW8RqU:+jmxThRo0irN1xSb9WuqU
Score

10^/10

infinitylock discovery evasion persistence ransomware spyware stealer trojan upx
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Renames multiple (72) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1