Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00482.7z

  • Size

    27.9MB

  • MD5

    9bf6d6ed36fbce36dfa9c23d594d677b

  • SHA1

    c922fcf9bc1dcbf8bbd992acd4834a8110e40477

  • SHA256

    2f4c48af21206e7be9d0a59ebd7ced2b5f2638dad52f76389adb5317fddf9a2e

  • SHA512

    ed422d7e350246861d7ff2d56cd86f925233a5682686517f73e645cccc4ea2dd146a78811dc9389872ec0bd8c7bc2327a8f37fed905f0b8c48c4b5655076f9b7

  • SSDEEP

    786432:uD9Xo4F/hdhUY+mF9nb5QTqEtTH+3+U5Pe2n1GlBINEyFnx:qYu5dO3yJ5QTtTHq+2f9dx

  Score

  10^/10

  avoslockerchaosdjvugandcrabmafiaware666tofseeurelasaspackv2backdoordiscoveryevasionexecutionpersistenceransomwaretrojanupx

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    ransomwareavoslocker

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Chaos Ransomware

  • Detect MafiaWare666 ransomware

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Modifies WinLogon for persistence

    persistence

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Clears Windows event logs

    evasionransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasionexecution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1