Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00458.7z

  • Size

    118.3MB

  • MD5

    aba1e47a960ba23d22d235f4aec6501f

  • SHA1

    05cb11ff2ed576f5822662e0d1a50bfb0b5cb191

  • SHA256

    af2a46b92d79251d328392ce1241fffc25acd6e797ff1e64859938e03c1e593b

  • SHA512

    f2d400dc63f50bb20b2cc07252ad21ce0254975a5daf26141806d6b60c75760051defda62e7d1f29986af891904b4eb4a2c7088c0ae756aee4b11354eb61bae0

  • SSDEEP

    3145728:US89S8h9S3iAuu9bPUMp2h0ylFEG/0QhiOb8k9C:Cl03iAB9rUv0ylFHW

  Score

  10^/10

  bitratconticrimsonratlockbitmakopvanillaratagilenetcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareratspywarestealertrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti

  • CrimsonRAT main payload

  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat

  • Disables service(s)

    evasionexecution

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • MAKOP ransomware payload

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Modifies WinLogon for persistence

    persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (1994) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Vanilla Rat payload

    rat

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1