azorult

Sharing

Copy URL

Twitter E-mail

General

Target

RNSM00372.7z
Size

19.1MB
Sample

241105-1zav8aynhw
MD5

511191aa5b0b84b16198a2fd8a1a070e
SHA1

1d1e618dd3ff7c16cf50177e5835b93236193173
SHA256

08c542e9381f386139d8313d0bb3d7a0906ead3cae228a075f518c18d7950b6d
SHA512

48c1f3a87618e9ce6038aa0b69091d8caa29dc63c0ef60d93bec63a990c9244d552c4fa119aff579145f5ad8c971eba361e186a485580d1d7a1ec9ac84653c34
SSDEEP

393216:XG3AJY8au5+qpUSohVYxdM8UZwY0pG0sDDqKnxp+fAVbbz2mwGQy:4IY8qqp1ohOxdswYoG0uVzMGl

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3350944739-639801879-157714471-1000\MAETYEJZKR-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .MAETYEJZKR The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a92a34d708e46a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAGLZhA5zFKZCjgylowrqvnD/lViDlrdnjNqNPWfmR6M5kYJkHS7ZW/hm1ROKAILdbwg0RFDMzPYVkguyR8ET5/TsGea6dvjdTVfXS7qLrBYM0a51LFplv3iVVVkQI11EvQSGEP0xEaTJlUQ/yEjfXhuoTnXCCaMQQKJuHiAY1EHtPwz3jBcvVmXa30wnE3P4jXhZpS2Z/QgyVPrNdGLBnszqIbrvf2NX57oxzsWBD9+XlqBf+/f5ACbVHaS/wPIGlSP1DhKa8qhpMqImp9dgj+z1ahTKSFOlguZ7ts/L4czNs9qYB0qnx5s+X+1ErNtG3haq6j1uoQGo66irbUtw81b/0BzYUwKghs3DxFyWfdPBi+q+dynpGJ8k4+Nwum0csXx4mk/kK7PrxiycbFdJuc7acKU8heDxThNyl7pNdq1bTNiaLCIXMCDQdWsfJHuS2jsBfcCvf59qRc18iRugZ11G6ZgD5xC8EkoGByZKJNqHI++rhHrv2GToq9dGaDYm9nPjd8aJE36+DWLIcVQAazXZZCGfjmrFZcl1YdFmnArjgGhR3wfFptQB7i5XYmBVvXRoUo/CkUdAaxOm+I53lZjPpXctW6AMbuwjWSGqDviH+OCFe9HuVTqJuqIdTa9a9rmPtV5omIHd0pCtkguft6lGwDcbM5SbAFUqTcNZlpCWGjTam7vDaT2suG+nRNmahrh9mDZmmSWjzGMLeZnK7vRN2B2N2X97g/rusn+83egB6fs1C4qHU81heK3s+vyC9NBNmOkiz9m+KvZL+56mbbu5iP/R1xU2Z9ic35iUky5nyzXj7pxXW6LUdmqe6VCZJYuFVeNaPyn5kpMe2THUTL5DiZmzM9w8PQ5CgKDBX5Z9I0rTqXNx4cUH+JObysPQJk7FQQ3nHH8gfOF1HXpjK5F9u2xW+VAGtEtqJ+d6Me+Z/+rlLjrNb2dusbuVo8Ns2ICCPMNBTLyBmhfl2y0hV/qRq40UTMOClphOAH3LV+tcsmRlZbb/Q1DEGQ528W830Xc3DeD1/SWn51o/XG4x4rBYcjFVjkx00qZKY2ouIlZiamKkMA6XDdkPVsKgCMYmehQxhVv4EEjJP0jX17ugSerppIDha4SzmkYw1t2s2Spr6cSitERq+l+dX239MP2LSrOEvD2eE1Wk+sN/x8J47bV7ggBEYu6yHXuOL0NhayQ3Gh9iyTfQmNOlfY0EKK2fQL1cpTvO0w7t6s8ODoCvoZV/2zX8p/qlFuxbw6GkjeYDgzJjaE9AssXrehGJRG0m/J93F49SZcb4Is3eAfcWKW8EPC7Z3ndZ+oVNGofrzDAPjTtr7mGWS7pd3Lqg+yT+iBtZ5A6Ebuj/IovI1YSg1clRTtknNi3Vheb57vfyqoevjnI82bTEjncziQhXY42l/I44SjLHmIrHIsHq4xDfoQH02LanRVqYoQCwCC8eY3LbDv6gBQaxe+f431noQdgQDkzYDOZhaKCezJbanne5bI2RePds+Zc+vu7XQqKADnliF4WCKYPfGxQR64h7GZD7HeUqUfvmL4slX/dwaC6jp3EmeSNM8eScZFWC1WET++98GYDxL/6iuvMBlPwkvCErca43YkUfP7kKgWwj3aEEfbca1Xjy/3pkjiJTwNru3cayZdl+zLNsAXOwHnixNDuA/20kNi/rzVSCDBex/WXFI8GGPn8N3Tx7NDv4BZBPqGE/U05u8l4VK2c/brfDaNiVNGq/BBoByREDcCyOjwAJ7ifw+VgjWSWMaFSkDqh1GlE7GoYZpKZ8Dy3p0fxm3RJLGTvNvVG+NcOqNrosXzJUf0xrDzohZAN9orCMivdjqUs5xEPuSewk3LCaw8TzAYsMOo2o3v+rKRt6Pn//skoc9NxqFtxQQr3mWHBOxVZzow8dFoDMS35B3xnmys9Oj7lDC8u5Hi1E1sJhuQHXXioUxGMRAOU7+ts1iKBQKgUdG+j3ar6CvMyBS2iD9wuRNSymCnXk4vbJaMCjQxn70Yo8oruItgscLobZNUqW7U4QzLXgfjQFgfdbs8Wqwb+vJaO9nfti+phnJRThKA/maCD3wiMeqeCyDK/HJo2SJNXsrVyWZxuUPbHN8sCq8oqHNerSfWF224AHP3GXQVANy+oAVRd8QIVWSnnHzdAITb0KgPLpyF6ZqWZ/aIx2watnLs5uftX3CdVCCLUAmJE87QY/iKEBj0doush0jqao0yAdVEKqIxDyxNIRnd6PHs0P8IgFsts4iAA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDx9NrJO5DbAuCVsODTRW7IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJLNAEBiZq/8Y9R+S3ZbHLmdSRhEfVP93y+vM0LKLjAaO2r1xWuOYPT0rJqfbML150zff7S12zgaAvoTDFrp2MPDax4ChLud7oMFoL6iSV1emrqBtvYrwErt4ypy8F1f6lXzmT7qp4AOwkgU+wPUyub+sf0dwlLRyjx7jQwF3i9DPYKPigj42cWKb+7QkcvCqikoFdEvhEtCM4ANjhxtQXIE71RkHCybyMY50L1gs/+uQFeywEnXTKCo3rMtccPEeVKMovLqkb/gmOcGmVrrCCEY6sTrSMnN+abEImb4E05FHfczjSgqIbDBfFz4H7qFFwi0aAxMzGs3U= ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/a92a34d708e46a

Extracted

Family

azorult

http://inixnetwork.xyz/index.php

Extracted

Family

sodinokibi

Botnet

Campaign

474

Decoy

golfclublandgoednieuwkerk.nl

glende-pflanzenparadies.de

blavait.fr

sjtpo.org

trainiumacademy.com

vitormmcosta.com

guohedd.com

reputation-medical.online

pixelhealth.net

bluetenreich-brilon.de

smartmind.net

breathebettertolivebetter.com

thegetawaycollective.com

cainlaw-okc.com

slotenmakerszwijndrecht.nl

malzomattalar.com

premiumweb.com.ua:443

iexpert99.com

mayprogulka.ru

magrinya.net

Attributes

net
true
pid
7
prc
msftesql.exe

sqbcoreservice.exe

dbsnmp.exe

winword.exe

ocomm.exe

xfssvccon.exe

isqlplussvc.exe

mysqld_nt.exe

firefoxconfig.exe

thebat.exe

sqlbrowser.exe

agntsvc.exe

excel.exe

sqlservr.exe

thebat64.exe

sqlagent.exe

thunderbird.exe

visio.exe

mysqld_opt.exe

outlook.exe

mydesktopservice.exe

oracle.exe

ocautoupds.exe

tbirdconfig.exe

ocssd.exe

mysqld.exe

dbeng50.exe

sqlwriter.exe

onenote.exe

wordpad.exe

synctime.exe

encsvc.exe

powerpnt.exe

mydesktopqos.exe

steam.exe

msaccess.exe

mspub.exe

infopath.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
474

Extracted

Path

C:\PerfLogs\OQIJYDDDP-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .OQIJYDDDP The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/a92a34d708e46a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAABiCLjol68VnOxZGXQR/6z+Uo9Lp/VI8TLSMSidJGGMRHgpD+8ocTUiMvjB7fQAzxWkkOnRPSK2SoSeflJCltOe3aDo6hnSbucIKIhqk0XC4B3EjlOUEFOFzak3ComDdNi/3lLX4Tgt8oA3/zhsxhRd9s/q7XbWM8QKk2EqRsqi7ULXhyVLJcjowph4RnlfHNIAhsYwQnKaJFwWlS0qkd+4jI9IWFUqikPviuqGo1uFm8vBl9TXsgDeNfBOshvxdNfFtJA/nGxL001tqZQFJDcoahHydwBCQb+UT/9N8CyJGsWxotTKvgC3GRTLJ9f2wJGXftQNEPhPmzqQjHGB6UkLxT+Qf63FbpWuecp3foyO378Aoggw1vuzClbRH4ks6naHC7JdOFDtPPrePGWg1C+L6Uvp2jRUgRkDN4okdaDotvazBu5p9VBMC1YBrodMTDlxpRNERc/d+rVNk5IOYbJEFkCMoYQhTVaZq9VH/kcXqnZ0lMQVTDwu8Od98vWiZgkQaeK9gWTGeSHhpMVeZMfhQmAG76MJh2waUvwCjGiRxlHiRw+KCQjiEiZwlCZPzySOm7U11No/wUw1ASP6qArKEPywTj9ARoGiup3VdfNznOriOY00oa63xsHsbtbqvSzr6uODpCwpPR+Dix0LCOfV/ABY7DheX3Lk7dqB3i4/I4ZkqjLjGL/wgoXBOEHhifNqROIPi/yIk9d9N9ivKlKxy10FpN5y1zAsHwFIRdPQTdH/7rzBfEkSIM6X4gLxXCOkD7QDOlSUXCXieoJqc+8TXpVkqdN20atcLA/IRJT7NoxEWohemueRYOiPlkbHm3yMegN02LDT+qcMHYzHEQO4CxkHr1MVx4xYMhzvbJ/perqy65PeTrfhdjoEG5n4jHZhTvvu5X79rxJtuwNNzlbEifI8Wu65eeRrgH8QLwL7o9shHnyQ48rhk15p2RQKT5lMBHhzAnJgkVv+l01M26DFy/dQlmNTrG0HBL6klAtxu5dPl6k+W+Yhjlk27RIjkjULhoCAuLWspjrPSkgR/KbsyB61s/2K/Djzcgk1ZMbTVYGTUPBavHx2auq9xgxQL5BCPoA2sRZTCue8XxEsHnKeetGh8kEgReZoEzL3vfU+m37WR7tueecnjzGDYpHTWYNLQoncFEvqQ74rdcOckb60tf2dBsdtWW1DNr2P9wnDpzIwFJQqkMyUgCLPjqpezCDILtBEPrwCXZQxf8kDcABnSRoPR9cPz200AOG5YV7vI/RL13KD+m3t8XQGXXUW2wc8xL4tvsGy99BoXPkHVSwyMXEMXizm8FbAOTLTijozzfWXepo9HMHjR3zYF1jj3pmjWtNU9rGgp8W3d2kYGvv9n3edJscboY9jl4YrMQaMHq0pAWM8+CdxVjC49RY2Zf+a48CLtIt4oJeX6gR5KbkFh1fU4nRvnP9o8qyLk48JhSrJABitxoF1RZaewReZEst75PZie0exBVNskhcxTXAezs6rCITyf/Eo6WFP54Dqncqkw8YfqIWixVQPnS0qk1N0sCGNs7E6HtTPYERJ2HpV98Ob6nqaHoKfAplT0rV4THu2P03X6wOMimszWQZV5xXZxIYj+7F9YPzi2Bn1GMbRrG9o/zBfeUuIK7JUFZypRtb41LrLLmCr2o5+JA4sL5W1/Yig0ZUcBWO88ucncEQZpcIofLnfAZaxxnwHtxNcNhL2ckdbX2U86Lnu5uw5nAuPoc1fY/tvSBPN7j5Eq1jUzX8HvwMSxmZNa2sk9NX8NId6tLssCNYxoImlBOgF/LhQ3Av8v2PwzS/GcxfRl1bGgk+93QksIY8kawkUW0yL62FGD9zOfaqv4cKQckzppCwvRj7qKPCsy2qZkh5bWB0wnuCkmZQeXzhSeAyTVSIRxwTXmt2piQIMtfVjbuMwTXr8XB+uLIDQMp8SwYnxMC+ku3yw20Q5lgOjohhv8+Nk2aECUYrCDTNLqBgyhfeGyjlC0QMTkV6nwAdCliIaGiHUUcyR9wQHtXUCV19L4FBPA+dYEomlMLzYpYIJnJM9Q6TRQKz/qac4PgS6LhfU+0iqjb+lAMn8xT5boD3Yi52VodXownHwmin9toNJWLfKsb8Ak8Rk+RzGrMUm0utFrAjYsL0IMUpbmyA45r+vYrfs1j3BhHvF7q0v7intZhWnOLppPhQ2lZOs91N0z3k7u2mpaJ24yJ151KR3IypKIo8qKfYX37OSnHiJN1wQ8kIvJjb9eujw= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZYTpFRuXYe7nxWsLfGTGSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBseKt/2Q2QOslGt9YOFqEBiftpRGDEd0bpydD4s+4Y6a1Y59yZIzQ2XGit5RiTQcqG1PLJO0JoZFtwNEoBBPAnKk+Ce5WALmfiWE3g6prNw3rxA1Kwg71ZibpDRFP3vPLNeah1wUZM3QKRiOKdjmn1ijgHH94mTzf9yzwQUhnmbIplsuw43INVYzpfzf8fBAcY8BqP3VNhX9XQ3PC2KZKEuftOkjxBd1MYJH0HpMOeL/YRZoP4YksV8zuv7OczMv9P3YFh8oz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/a92a34d708e46a

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
SMTP.yandex.com
Port:
587
Username:
[email protected]
Password:
Ilovegod12

Mutex

649c2c45-aa3c-4919-bf3f-8e3624fcf690

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Ilovegod12 _EmailPort:587 _EmailSSL:true _EmailServer:SMTP.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:649c2c45-aa3c-4919-bf3f-8e3624fcf690 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Targets

- Target
  
  RNSM00372.7z
- Size
  
  19.1MB
- MD5
  
  511191aa5b0b84b16198a2fd8a1a070e
- SHA1
  
  1d1e618dd3ff7c16cf50177e5835b93236193173
- SHA256
  
  08c542e9381f386139d8313d0bb3d7a0906ead3cae228a075f518c18d7950b6d
- SHA512
  
  48c1f3a87618e9ce6038aa0b69091d8caa29dc63c0ef60d93bec63a990c9244d552c4fa119aff579145f5ad8c971eba361e186a485580d1d7a1ec9ac84653c34
- SSDEEP
  
  393216:XG3AJY8au5+qpUSohVYxdM8UZwY0pG0sDDqKnxp+fAVbbz2mwGQy:4IY8qqp1ohOxdswYoG0uVzMGl
Score

10^/10

azorult gandcrab hawkeye_reborn m00nd3v_logger sodinokibi troldesh 7 474 backdoor credential_access defense_evasion discovery execution impact infostealer keylogger persistence ransomware spyware stealer trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Azorult family
  azorult
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- Gandcrab family
  gandcrab
- HawkEye Reborn
  HawkEye Reborn is an enhanced version of the HawkEye malware kit.
  keylogger trojan stealer spyware hawkeye_reborn
- Hawkeye_reborn family
  hawkeye_reborn
- M00nd3v_Logger
  M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
  stealer spyware m00nd3v_logger
- M00nd3v_logger family
  m00nd3v_logger
- Modifies WinLogon for persistence
  persistence
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Sodinokibi family
  sodinokibi
- Sodinokibi/Revil sample
- Troldesh family
  troldesh
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Contacts a large (7733) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- M00nD3v Logger payload
  Detects M00nD3v Logger payload in memory.
  infostealer
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Renames multiple (315) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1