Extracted

• • Target

    RNSM00365.7z

  • Size

    21.2MB

  • MD5

    3dcf38d6eb0239f2371910420c478d24

  • SHA1

    db2fd304e4110b274df019eafdddb734a21c8a6e

  • SHA256

    9d5387010b7383c83509798c3acc2228192602c93b54ab3b2a8bfb630a1347a8

  • SHA512

    be720f8e324083417bc19814d529792bff223ed45e6ad9f6cc86df8a796cf9016183704c0155de955d9300c1cbec43f9aea2d826115e39d31bfd2ba874ae39fb

  • SSDEEP

    393216:VKc/3fupUewDJCuZkv1vTFMI8+UkcHhuDIfaPv+vVMMyPqBoeu5/dwNX1/:V3H0U7kv1v2I8+WhuDIyXQVMJHGNF/

  Score

  10^/10

  dharmagandcrabtroldeshaspackv2backdoordefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • Troldesh family

    troldesh

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (214) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1