Extracted

• • Target

    RNSM00483.7z

  • Size

    47.3MB

  • MD5

    089cee221e08d8edad93795d4a0ddacf

  • SHA1

    56c1ef11b308e8def30e19a8cd2b5d908eb20c78

  • SHA256

    75f2278a58d14d126c9bce4e31b527cd258bf00ff36ea128374a5f2bf0f86e5c

  • SHA512

    ea2f9f01ca0681e73d27c03b609a0c3ecdc9cc78d4eda03d88e844961a267ba63d81caa6e5f3cd6ce122a243b8dcef5fa5c600ac1b410aede0a8f1dd4ed0db17

  • SSDEEP

    786432:4g8X+Ijnxcyzew9udeAhP5XltZehEExusKZhdINIsLyVhm08ek9GLEUUSccH0I:4FuMxZeL0YrzE3qdMLyVh7orUUSh

  Score

  10^/10

  avoslockergandcrabmafiaware666aspackv2backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealerupx

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    ransomwareavoslocker

  • Detect MafiaWare666 ransomware

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (161) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Modifies Windows Firewall

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1