Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    RNSM00480.7z
  • Size 26.3MB
  • SHA256 3a6cee5509bb09d4e479d91dbf1ba292e76686c14c6a1049de7c0e0ddbdf7a2b
  • MD5 eddd0c8d8f9919c8a2d18a25047d1b8c
  • SHA1 06c72f0c222805e448a3a5f15c204ddca9b65492
  • SHA512 68c7cb44dfc9c2b184844825e94a7f6ab122ad0eae8a1bd6eaf1132357c209976563eea702b5f6123a23c682f9aff23095f5307954809fa3e93ff0ea14eb3f6b
  • SSDEEP 393216:pSaU4WVWKWzPcGR3Rh5+bNAyie1ZEkkR7jxxacZ+HrMBnmHcLN0uYXKY3CBB0Ddl:dXTbR35S3PPe7j1sYg8LoXvSB4CTNA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  atomsiloblackmattercerberurelasxmrig207aab0afc614ac68359fc63f9665961defense_evasiondiscoveryevasionexecutionimpactminerpersistenceprivilege_escalationpyinstallerransomwarespywarestealertrojanupx

  • AtomSilo

    Ransomware family first seen in September 2021.

    ransomwareatomsilo

  • AtomSilo Ransomware

  • BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (132) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Contacts a large (1126) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    evasion

  • Patched UPX-packed file

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1