Overview

overview

9

Static

static

3

HostsReset-x64.exe

windows7-x64

9

HostsReset-x64.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    HostsReset-x64.exe

  • Size

    43KB

  • Sample

    240818-qhrgjaxfpr

  • MD5

    732804ad6d4c9cdc4f0e4d138a31be35

  • SHA1

    2eb623e28f33132dc93f5c1796a31ce893ecc7ca

  • SHA256

    442dc3e79981dfee74bc88b49eef1cf2ba7ccd9f94ac18d9262b89487cef8b78

  • SHA512

    c132b17a620687ac50236fcd8cca6f92f858f28b1e5029aa21b7a40b9a3a6f0b8f3fb60f54344f3839b78f8c4773e0b4eed26ca560a52bdd70bd378db62c8b5b

  • SSDEEP

    768:SMdZxZdhg9ElftdTdkbaPQPYC7Oetvf9cHqdOm:7x5ll3eaXC7TJ

Score
9/10
discoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      HostsReset-x64.exe

    • Size

      43KB

    • MD5

      732804ad6d4c9cdc4f0e4d138a31be35

    • SHA1

      2eb623e28f33132dc93f5c1796a31ce893ecc7ca

    • SHA256

      442dc3e79981dfee74bc88b49eef1cf2ba7ccd9f94ac18d9262b89487cef8b78

    • SHA512

      c132b17a620687ac50236fcd8cca6f92f858f28b1e5029aa21b7a40b9a3a6f0b8f3fb60f54344f3839b78f8c4773e0b4eed26ca560a52bdd70bd378db62c8b5b

    • SSDEEP

      768:SMdZxZdhg9ElftdTdkbaPQPYC7Oetvf9cHqdOm:7x5ll3eaXC7TJ

    Score
    9/10
    discoveryransomwarespywarestealer

    • Renames multiple (5003) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks