Extracted

• • Target

    RNSM00320.7z

  • Size

    1.6MB

  • MD5

    39ff9a6a7b15b4bda77edcb789ae5f8a

  • SHA1

    668e58768e9676bcb9945fee78699487b8308cea

  • SHA256

    2737cf080df29967878d0f4161291dce55c2fc40d79f9c42ac51ae31bf624b07

  • SHA512

    5be455c739e1018c9443f122fec602ba447c269c1d97f630f49bbe076f84dc8d32b9d1256b4016e08bca9af5c7de244c6237985564e6c803051e4f9cafde9476

  • SSDEEP

    24576:R8OMBf51//LOZFku7d/t8s+5hyVWaaH6pdSEYzUiSomNdhII5Q:eOMR5Z/KvkuNdG3/WdSEMUMKqMQ

  Score

  10^/10

  dharmahawkeye_rebornm00nd3v_loggertroldeshcredential_accessdefense_evasiondiscoveryexecutionimpactinfostealerkeyloggerpersistenceransomwarespywarestealertrojanupx

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • Hawkeye_reborn family

    hawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nd3v_logger family

    m00nd3v_logger

  • Troldesh family

    troldesh

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • Renames multiple (102) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1