Extracted

• • Target

    2024-11-02_ad704f4d50d21e895c9cfcb8d78afdc6_cobian_krakencryptor

  • Size

    10.2MB

  • MD5

    ad704f4d50d21e895c9cfcb8d78afdc6

  • SHA1

    28cf5bad8f3bc495be1f966238289556de59fc05

  • SHA256

    030a17891ab814bdb6a92285a0c92443b5cf797551c3346dc98a4fd65d856d24

  • SHA512

    046ba78deafbe60ab87a0014a8ae5c32ae0a49df873ae899a96aaa634708591dd280600e1649ebd3159003821f337fc1cdae894bde8add3baca7f4d40a54f146

  • SSDEEP

    196608:GwfrvAXkRHbisSjRjnV9RB6PAx0WZHCWYSl/95DW:xrdR7IRjn3uODNnPhW

  Score

  7^/10

  discoverypersistencethemida

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence
  behavioral1behavioral2