Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00477.7z

  • Size

    22.4MB

  • MD5

    e74213e7f48bbb4fc4fba13f0bfaad96

  • SHA1

    ed97322c26c9f7a028b3c587b5d1aaf656b0f22f

  • SHA256

    f1495ff599ccc310bb271cdb147f212dc55a6964e46fe037268638e32d591988

  • SHA512

    c520dac8d25ef5c0864f81e2573dd049fdf5887cbd601488f633549713696a2ac0dd8b4166531c9a40a40010d01381d13f12e7266a7d3b633422618e3bd6d0e0

  • SSDEEP

    393216:uvQVZl/lgu206A8Vdj0RlYl2g9jQ/kWwjTd4hoSGt/D3rrKAqUpW1Zb3CDDoX25P:KQV/lg506/djICP9jQ/FwtivGJ3r7jpF

  Score

  10^/10

  darkcometdharmadjvunanocorenullmixerurelasvidarvjw0rm933aspackv2defense_evasiondiscoverydropperevasionexecutionimpactkeyloggerpersistenceprivilege_escalationransomwareratspywarestealertrojanupxworm

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Detected Djvu ransomware

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Modifies WinLogon for persistence

    persistence

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (329) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Vidar Stealer

    stealer

  • Blocklisted process makes network request

  • Contacts a large (1134) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    evasion

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1