Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00446.7z

  • Size

    68.4MB

  • MD5

    3f1f1933521d96cb2a537eb57f0b8f4b

  • SHA1

    24b372467e9a2ad7aeac32ddac4aa71f22f3833c

  • SHA256

    b964e2c619289523043166d503c2f16b7b350f49533bc72d986adf09377bced0

  • SHA512

    251905f5fc6d738a8465ddda9d82cc357f9d2197fa9a7023447145b19587d1b8be56cfc7f0481f879a74bd9a4cd1777c929c90b76740de88bf4a083ca0ff0e82

  • SSDEEP

    1572864:WK6vBCJ4ynaQtuzbKsm5v5P04ljYEKR7sttLlxmi3bzvBZVdr:WK6vkfaBm5cCYTsHLlJf/

  Score

  10^/10

  contimafiaware666nullmixerredlinesectopratanicananewaniagilenetaspackv2defense_evasiondiscoverydropperevasionexecutionexploitinfostealerpersistenceprivilege_escalationransomwareratspywarestealertrojanupxvmprotect

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti

  • Detect MafiaWare666 ransomware

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • UAC bypass

    evasiontrojan

  • Clears Windows event logs

    evasionransomware

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Renames multiple (153) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Possible privilege escalation attempt

    exploit

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1