Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00442.7z

  • Size

    88.1MB

  • MD5

    4b38c460395d00fabeefa4f8ed666f42

  • SHA1

    267f3cec8cb2d370e66b2e38a20e795dd3ac136b

  • SHA256

    637818d66515e2c06402e23fe770314f0776dfa9816c321722d01d36c84eb63e

  • SHA512

    d0e9d0925abfb8a58416ae0764bbce1e0f1cd272e726b7b2bec1db72274a5e9df664e86cb895415c10437c7269831ec7dfe75274b0026431b898d09244dc31c2

  • SSDEEP

    1572864:hodAPPOiNbJytutfKZ6sl/r+iFESVxyFhUCYZxSGzlnrleOjLQ5w0N5L0RA4vz:hTWiNbJA4PAr+i4AfSGxBeOjL8L0Tz

  Score

  10^/10

  avaddoncontigandcrabnjratredlinesalitysectopratvanillarat@andomian@vtreqqhackedbackdoordefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwareratthemidatrojanupx

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon

  • Avaddon payload

  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti

  • GandCrab payload

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

  • Vanilla Rat payload

    rat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1