Resubmissions
24/08/2024, 06:42
240824-hgnegsxhje924/08/2024, 06:42
240824-hgmsysxhjc924/08/2024, 06:42
240824-hgg8gaxgrf924/08/2024, 06:42
240824-hgglyazcnl724/08/2024, 06:42
240824-hgf1eazcnk924/08/2024, 06:42
240824-hgfdwaxgrd924/08/2024, 06:42
240824-hgescaxgrc924/08/2024, 06:42
240824-hgd6taxgra924/08/2024, 06:41
240824-hgatdsxgqf924/08/2024, 06:41
240824-hf9w4azcmp9General
- Target heavy.exe
- Size 161.8MB
- Sample240824-hf9w4azcmp
- SHA256 88093c75834d60df3b4b6f4df642bb28dc749f4bd562f587fa8f9e30e97d3c5c
Score
9/10
Malware Config
Targets
-
- Target heavy.exe
- Size 161.8MB
- SHA256 88093c75834d60df3b4b6f4df642bb28dc749f4bd562f587fa8f9e30e97d3c5c
Score9/10-
Renames multiple (69) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled