Extracted

Extracted

Extracted

Extracted

• • Target

    RNSM00417.7z

  • Size

    26.6MB

  • MD5

    3827bb44108eb019f3d69ec7c9a4c85b

  • SHA1

    3cc6563e65ff0618cee4bcbb8637db128af32c0a

  • SHA256

    0c05113830f590ea0e628c188bf2b0d9554c6e6bb3bb80178b193caf5bb41c96

  • SHA512

    2e575b82c5f1d25233f5ef8ec2042a54a0b21127e73bea1720e8189f57d709879be7c693456217c8d65bc55ba89e51370c3f3fe603fbd3ff07e247c8da5e6caa

  • SSDEEP

    786432:bFe9AF5zQqfplDfrIxRMmGBN63q8bv5ceUPt/q:bFVpjlDfrIxRMzw3lme

  Score

  10^/10

  globeimposterlockymafiaware666modiloaderbootkitdefense_evasiondiscoveryevasionpersistenceprivilege_escalationransomwarespywarestealertrojanupx

  • Detect MafiaWare666 ransomware

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter

  • Globeimposter family

    globeimposter

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky

  • Locky family

    locky

  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666

  • Mafiaware666 family

    mafiaware666

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modifies WinLogon for persistence

    persistence

  • Modifies security service

    evasion

  • Modiloader family

    modiloader

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • ModiLoader First Stage

  • Renames multiple (1663) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Allows Network login with blank passwords

    Allows local user accounts with blank passwords to access device from the network.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hijack Execution Flow: Executable Installer File Permissions Weakness

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1