Extracted

• • Target

    RNSM00427.7z

  • Size

    67.7MB

  • MD5

    573ecb2b0c178101333226b58a598405

  • SHA1

    dd6f8e4a8e6fde2ece292247ca286aeb2e1be2c0

  • SHA256

    1b4db01337060068acef0e5906b390e9b7102efb194c1f72a5ea7a9b2e2c27db

  • SHA512

    3d1f5f568f579a5b5e3ec69303f39c89bbea61aa060bb44e3eec409759d8d62358439f50b80a076d9d5bd0f141473d92e75e446d184a9775ebf9d44c68596f6a

  • SSDEEP

    1572864:obkPM3DDlUg8opzMTHZQMeBmNUFJVJOn6yJL+vJVs6XctX:8nlH8iMTHTbNUXv66JVZXctX

  Score

  10^/10

  dearcryzeppelindiscoveryevasionpersistenceprivilege_escalationpyinstallerransomwarespywarestealerupxvmprotect

  • DearCry

    DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

    ransomwaredearcry

  • Dearcry family

    dearcry

  • Detects Zeppelin payload

  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin

  • Zeppelin family

    zeppelin

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Renames multiple (2433) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1