Extracted

Extracted

Extracted

Extracted

• • Target

    066d06ca007d19457ca609dd95975f7facb551ffb5d8f6d4edf108236ad8c981.exe

  • Size

    1.4MB

  • MD5

    8f96e8a051cb8df97a27c36dcf71d585

  • SHA1

    96dcf9b846ae8710a06e24d0f12b2b98446810af

  • SHA256

    066d06ca007d19457ca609dd95975f7facb551ffb5d8f6d4edf108236ad8c981

  • SHA512

    ebb56e6fe4ef2e5f5ccb429efdd8f6090761f8822c8acf6e466424f5d86b1238d3bad2236748dd0b9ce04a5f68e4fa15cc8714f1088031ffe5c3d41d2b2cdd94

  • SSDEEP

    24576:wD4u03Es5iL6J4H1ZMJwOXWI3ZsrHjS/7YftKna/Rgy9c9fa:KIl5im4VN+2e7YfkUcZ

  Score

  10^/10

  gozibankerdiscoveryisfbtrojanupx

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1

• • Target

    06d6f22d02443afd6d6880ead6648ebc.exe

  • Size

    533KB

  • MD5

    06d6f22d02443afd6d6880ead6648ebc

  • SHA1

    29ef56aa5cb2cce284c91ab9ba8846b47b704028

  • SHA256

    d3c3ea95931fb3556b515ef829bec48e8e387dd94b39a697b736b59f75097ef2

  • SHA512

    27cf6e0d4c7d968f7240338847bf89a2d5de917e73adb0f862c1db5f96b4db41457308ce6c6091c67ab971c164c120a9475174d2e839fca1cd06cd35a8312e07

  • SSDEEP

    12288:djkSKd9PiZSkv8mnthG6Voysfsa+T+R0s+R0zBzsd0Da0G5cXgK6F+eeS:iVmSyjesh+R0s+R0zBzsd7J5cXg5e

  Score

  8^/10

  discoverypersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  behavioral2

• • Target

    09f1d49065108a595578ff86ff63a514d47d5496ab5c23f38cda1f0d57dd6cd1.exe

  • Size

    657KB

  • MD5

    e9a81fb5fd86ba9a78ec6528c2b1ae37

  • SHA1

    bb0881b7179033710d26beded4f69a9a8b80702f

  • SHA256

    09f1d49065108a595578ff86ff63a514d47d5496ab5c23f38cda1f0d57dd6cd1

  • SHA512

    377bd6a4dd3de769d2c39248a9c4f4af333b5736012b4f9948c8887850c28bcee53f222d5443f9971d908aa2cd745811a71ef9f9277821a4ca10138336419801

  • SSDEEP

    12288:F5J9O/FV+fwQRM/u4sAmz9BtiSPUYT8gGgrluz:F5JM/FV+Iiuzc7MWGgYz

  Score

  10^/10

  locky_lukitusdefense_evasiondiscoveryransomware

  • Locky (Lukitus variant)

    Variant of the Locky ransomware seen in the wild since late 2017.

    ransomwarelocky_lukitus

  • Locky_lukitus family

    locky_lukitus

  • Deletes itself

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3

• • Target

    208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe

  • Size

    110KB

  • MD5

    c35506bd3fedad57e7f1ea975ebcaec5

  • SHA1

    0977676ae8c8716824a13037c7eb4c7b95c58ae7

  • SHA256

    208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145

  • SHA512

    adbc0991a10ce0fd293f3706583f44bd0805a97e10e45da896bcb2eb3cbc507eaeb711f2ff98df941d12aba9804fccc5c6a1948991fd278736360acd9b411b51

  • SSDEEP

    1536:vAakOZurAqbsvCFWc1dIgF/q52677fqdmT7K:vAa+rAqQufK7WET2

  Score

  10^/10

  credential_accessdiscoveryransomwarespywarestealer

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral4

• • Target

    241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe

  • Size

    151KB

  • MD5

    950ad3386d9ef1513dcc33a6955eaf40

  • SHA1

    3f2fac9fba7463796d19863b2b8075aac1a6827b

  • SHA256

    241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79

  • SHA512

    5a6fca53319fe95bd8cc2871c4cdfdad94750d3af87cb39bcb45983f25e8b031467e6747af5c60108fd17ed0faaca5cbe7167bff57d26e20d71dd90df75987e3

  • SSDEEP

    3072:gt30TGyfDAkXj0eYZNHJj2mYpO/FCfEtj:gt30SOpMNImL/QfEt

  Score

  1^/10
  behavioral5

• • Target

    30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe

  • Size

    6.8MB

  • MD5

    b5bae1ed2fde118e256ede9d86affe42

  • SHA1

    4870df80763feae4870e674a93515a2635637748

  • SHA256

    30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760

  • SHA512

    00c871aaf12b9690d99ec2797758e69a7513da378cf6d7a2f7e0d3c2095267b346aee5fd7585121bdd5c3ff112f832d810367788136c5bb68758675c4eec5bfa

  • SSDEEP

    196608:FCwwsESTbwQQ/lAL53VFOT0gLw6GfXduJvNKd:ozsESTbwL/E3VF8kduhNe

  Score

  10^/10

  discoveryevasionpersistenceransomwaretrojan

  • UAC bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral6

• • Target

    44f28cd6ea894c05030ab913e2a0f1f1596b4aa7c551df9381f521cb88a92f7e.exe

  • Size

    1.2MB

  • MD5

    6aa468aad5cfed969149dcaca4034b88

  • SHA1

    33cbf796ae5cb3c512ddd4c865f88aaa22cadc3c

  • SHA256

    44f28cd6ea894c05030ab913e2a0f1f1596b4aa7c551df9381f521cb88a92f7e

  • SHA512

    a121db38f37cff19dcd5ad5dd8e56bdf65c60784eb1e313cf9937c72ef6b6d12622350df191084db65e88dd017b67d2416ff72273d714c5b2e8b96c987760662

  • SSDEEP

    24576:f9Q9o30tdl+D5XJHE/7wNsZ8nyaXoGbxLBNoG35WQ9:wdludJk/7wNs6nZXoGbxYQW

  Score

  3^/10

  discovery
  behavioral7

• • Target

    4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f.exe

  • Size

    346KB

  • MD5

    99df60e4e6bd3497f40736a408dd0a46

  • SHA1

    d02937c29a00c4d15fbcb19a9afd85a9ad3fce6b

  • SHA256

    4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f

  • SHA512

    aa902f62c05b5682209459d354dc70d243125612fff1000879b5ee0d32b58c8b503a140942376483ad41de4c4d29502bf3f3f92a4a910418f9af3b5cf6671f32

  • SSDEEP

    6144:ffwD/eHK1rGTAOKPMrYB4D/lkWnIb/YsGG9zKL:ffwDz1+Nr84D/labh+L

  Score

  10^/10

  xoristpersistenceransomwarespywarestealer

  • Detected Xorist Ransomware

  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist

  • Xorist family

    xorist

  • Renames multiple (6057) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral8

• • Target

    72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b.exe

  • Size

    268KB

  • MD5

    4e2b58f99ad9f13c2b09f0741739775d

  • SHA1

    6a51d0cd9ea189babad031864217ddd3a7ddba84

  • SHA256

    72ddceebe717992c1486a2d5a5e9e20ad331a98a146d2976c943c983e088f66b

  • SHA512

    dd74f94fbe6324410e832ab22b2807bbc5bc4171704477898a2b64a1ce6a7b3a289a4fb399412152b33a6b286e439c8d89eca4d5cba7bcd65dcb864e18487ebd

  • SSDEEP

    3072:gfLB0w+Wv5pa/Dc/nuOL23e8aoeE+aqfnfj59AEYfzaBUGm+0lh831QPfrwV6cFK:+TgenuOLCL+559AEq+m+jmEIcFaNtN

  Score

  9^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8633) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Clears Network RDP Connection History and Configurations

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral9

• • Target

    7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2.exe

  • Size

    138KB

  • MD5

    6f772eb660bc05fc26df86c98ca49abc

  • SHA1

    8da75dd328c195b84f15740a33fc9888af4da2be

  • SHA256

    7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2

  • SHA512

    3e028cecf08ed4fe0100a7587f04ba4c4cebb023b371cc4e793a7dfb7be64a4d2ef8066fc352ea834c239cb7c5836626673e02fbaa63f4631b71d40c4cc284a1

  • SSDEEP

    1536:USX6DdHTs0Zwboo0z29sHH3ga/7/nvvgDD0jj0ZT8fS4D0rF4p4sxVZ7:36BZwlOn4DdTBDiusxVZ7

  Score

  7^/10

  • Deletes itself

  behavioral10

• • Target

    7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

  • Size

    443KB

  • MD5

    fd5ae61959c9590036881cb809891029

  • SHA1

    f930d520913b407ab3cb5d7ecf5ee2a7dca1c071

  • SHA256

    7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57

  • SHA512

    2feb832498370c7635d42913a4328b3ba797e67cf6f7cdadc769dd549b251b05f340899229fcf76ccc1f8fe5d1512d769f581079ac06c6459669d536ba1c1fbb

  • SSDEEP

    6144:I9LJ4d2DvM1V4LKPx7WlkJhW0lNVel9zXAjqiORKmb+Ylr48ov/P:IIdBrSKPx+T597iOMOTh48ov

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral11

• • Target

    8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051.exe

  • Size

    138KB

  • MD5

    911d5905cbe1dd462f171b7167cd15b9

  • SHA1

    bca38ab2f4b461e25e4686cfe523d3b0ed2d1cd0

  • SHA256

    8c42a084278ff8e25f7ee765c37da84da02780da725505108f9eb39cfb05c051

  • SHA512

    c60c274360040b2385fcfbc1f9cbc85cd48c9872d0cadcfbe0343efb16e5401af1b74159ecd29d5adeb519c2818bde022fd21b20c12e4dfb274351733d38b7d1

  • SSDEEP

    1536:IhcFu21x8xUoDq88z/1h5jOla6H7uTnkwwZI0qXAREZ+QOS4D0rtJ/lxABC:7DnoDjbin/w1O3D5J/lxABC

  Score

  7^/10

  • Deletes itself

  behavioral12

• • Target

    9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291.exe

  • Size

    24KB

  • MD5

    8a1225f47aa9f0673c32983f1b2b2c5b

  • SHA1

    742f2364f2d5f10385b56c22ecf17a3cdcc53346

  • SHA256

    9d081b734c595a1ae38e254369c0060c5870ee119c9f7853989c23ebc204a291

  • SHA512

    d633dc2caa28a0a782108b9d47d43322c6f1d95c82903219b4b83eb491691217916e7eee35a0eb206aae2937523896e538141e524b396c2ae7210ec8f8238827

  • SSDEEP

    96:/lx5KHYFNV+Vvl/iABo1FYXGgn2PUkWf2BtvXrs2aoE8y79h9jSUyrW9EhN:/TzmVvl/vaKdnvJeBtvXrsr352UyCEh

  Score

  4^/10

  discovery
  behavioral13

• • Target

    b25cc314720ced9b2845941fb145bbf06493fad7b2b4a76b8fbffc995ff46215.exe

  • Size

    392KB

  • MD5

    e3ea83c55b5ba8bafb881b6c928d2092

  • SHA1

    f97d4c11815cfae72ac597aa1ca355d0c6371ae8

  • SHA256

    b25cc314720ced9b2845941fb145bbf06493fad7b2b4a76b8fbffc995ff46215

  • SHA512

    37a34ca8774f9d6e3be3c14a5d560600bf468b5b9a3b68107b4b35ed3c466e1293996091f79cd20a1d91413b64c914cb2d879aeeb54537bf33a484e5722eda32

  • SSDEEP

    6144:6M0SzuU2+09ccA3F8b88LmJdWrcIIFPrZZYGa/Sd6ElhL6EYp0I:6bq49cw8WIpZZbaAOx0I

  Score

  10^/10

  discoveryevasionpersistencetrojan

  • Windows security bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral14

• • Target

    b2ec72de3543060f0f3af322c4f1caf2d65fa8ff56b5a93a5e8fa59c191d178f.exe

  • Size

    17.0MB

  • MD5

    66a5f61f37f3591291b3e722e38f7541

  • SHA1

    50e2cda0a2ca8e60358f5dd3892d0c36f383f919

  • SHA256

    b2ec72de3543060f0f3af322c4f1caf2d65fa8ff56b5a93a5e8fa59c191d178f

  • SHA512

    2428bcfac5e6ca5679ecc843faab346a1f7f6105543ea60422b86932365c0eb543d608349816947d4db1b1d09fa256b9d28912ec68bbef34683bf6f77096a85f

  • SSDEEP

    393216:XdJGflJtgolQr+2jWHkWs24nqBHrtQipdLlQPP8QVHPD6N6/:NJklJtgVtg4nqDLW38qWNc

  Score

  6^/10

  discoverypersistence

  • Adds Run key to start application

    persistence
  behavioral15

• • Target

    b4c2ffccfe807167860d70ea95cde0390f2dc4220992d272497ced04afb97edd.exe

  • Size

    808KB

  • MD5

    e49c40f6a69af400f2e11dd8fe6604dd

  • SHA1

    56107d38cc5a94c67bdb92aa7566768b8e82b1f2

  • SHA256

    b4c2ffccfe807167860d70ea95cde0390f2dc4220992d272497ced04afb97edd

  • SHA512

    80f782bf58a405559a1140be30838b7d46ddca5423d9001cb1f87005e0e46e2a6e20ae3229bd095e86d8f2fbc30020a7be8f08c7f47f095247168424b2412e28

  • SSDEEP

    12288:oTsKNGpaBPxBlvdtsYuj+Ue8vQjY7heDHcMicoXfC/ye:YNG+PxvU3tvQweDHydqJ

  Score

  5^/10

  discovery

  • Drops file in System32 directory

  behavioral16

• • Target

    bab7af3306f66d5deaafda1f0cd57c20e42678451a7bc70c71255f6a7e1806be.exe

  • Size

    1.1MB

  • MD5

    eced916de1a2ada7bfe61c85fd562468

  • SHA1

    9725342bb5daa1ab38d3874f43d819100cd922d1

  • SHA256

    bab7af3306f66d5deaafda1f0cd57c20e42678451a7bc70c71255f6a7e1806be

  • SHA512

    e151ad3c4c9b21c0228c54038623741606e0ffce373ee13dae18cd5ae1db4720c6b72efbfbc627e514973b9d7bddaaf93b84a87e8d6b072175633c7953942b9a

  • SSDEEP

    12288:UkTgAX4pS4ICUwJlY3fjCzxsHHZMuQa0no2L5NBqLP7r9r/+pppppppppppppppW:UkTgAX4V3UIyrusnGuxao2LTBqL1qG

  Score

  9^/10

  discoveryransomware

  • Renames multiple (110) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17

• • Target

    c531015ec09adf346131a375df9b9d04c90657fac9b80f2b1e269dae6186de86.exe

  • Size

    11.1MB

  • MD5

    d9268c17cb7052926a766046ae7b2265

  • SHA1

    c624e82cbc90bc0703ac98b05428221e484a8564

  • SHA256

    c531015ec09adf346131a375df9b9d04c90657fac9b80f2b1e269dae6186de86

  • SHA512

    047e53d729a776f2c3c4d3ff04b2cb378a8834c665c58a3825fbaadc9077b564e7a2b202391b888786e729d2b90142f98c752421363bf1b02088f2984005fdcc

  • SSDEEP

    196608:QxCzXIsPSSQ+xNYpT5/54H6w5gV3SHW0WbpSzZTfuPM5Jvghs1VTrQvG:dbIsqT+xNYFN54aw5XBlzZfOs/X

  Score

  8^/10

  discoveryspywarestealer

  • Drops file in Drivers directory

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral18

• • Target

    dc7ab2e7ed26554a11da51a184e95b01e685b1a2f99c7fc77d54d5966530bf60.exe

  • Size

    969KB

  • MD5

    93cb0053e883fb262f9f795f327152f8

  • SHA1

    a53b53bcc0250f7d01af7b507150cde9d4b65735

  • SHA256

    dc7ab2e7ed26554a11da51a184e95b01e685b1a2f99c7fc77d54d5966530bf60

  • SHA512

    db3f13bae7ff1a80a879a6e9c8a9295536a49f522068ef32578df796b2d9f3e0267daf6248fa204a51b439b870b784636d97c28c82205d32f83869d8327a7d8d

  • SSDEEP

    24576:1X5DkQZ0vl/m5OOWxrQ0SvuAs4uKWYLsUy:9CfvxYW0vTluKW+sUy

  Score

  8^/10

  discoveryransomware

  • Contacts a large (770) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral19

• • Target

    debfd1fb34df5c7047c3c8837cdda27b59e6044934447a8bb6878344847b74d8.exe

  • Size

    1.8MB

  • MD5

    84b51ee1b45d26e08c525d9c87a4945a

  • SHA1

    04d9559bb0ed6e964b05d1583a7410eca837f1cf

  • SHA256

    debfd1fb34df5c7047c3c8837cdda27b59e6044934447a8bb6878344847b74d8

  • SHA512

    d3a4c07119ce03d1199ed2e6fb98b1504c171fe1d8ce1d71c33e2f2562ad0149e4fd5018ae837d9500761ad3d73f30c48d8c44d72438b048c8fd5f914d3549c9

  • SSDEEP

    24576:sVLOUsdmcKn0RVIC0GN9eyS7QPkIIgmWmQL3taRHLM36T22CKRJqNE4u6FOcnDs7:stJ6F7PN3taRHwe3clnBowQg7K

  Score

  8^/10

  discoverypersistence

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral20

• • Target

    df36e2aaae85f07851810a829e38a82827252fda15d4c4410da085d59ce38737.exe

  • Size

    623KB

  • MD5

    a93b8e2d5292a52d6dbaa3b34c81beee

  • SHA1

    10a2a89542eccc52da2d44f182a45cbba1f9ed12

  • SHA256

    df36e2aaae85f07851810a829e38a82827252fda15d4c4410da085d59ce38737

  • SHA512

    b0016cc77c500c8d9203681268bc178f1f89d2e0b22d6d16d2a5a3e1a8538cb8b6cd736ceba033fa2c38c6e0f0e45bd431589fbe0ca67cf4f3d922dc918297bb

  • SSDEEP

    12288:aKwdOPG0Ir+MsFwdOPG0Ir+bxuEvt1ztNz0479wdOPG0Ir/:fev0U+MsFev0U+lustltNz04Jev0U/

  Score

  9^/10

  defense_evasionpersistenceransomwarespywarestealer

  • Renames multiple (1510) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Drops file in Drivers directory

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion
  behavioral21

• • Target

    df99316e57002298d88be785acad4c3a900cbc5e04a29e32d4549f25f08a7527.exe

  • Size

    128KB

  • MD5

    0902e1419adeb2bb7644e2c14ae79737

  • SHA1

    c5ca2c4fc9cbefe4868d3a0699896374745be150

  • SHA256

    df99316e57002298d88be785acad4c3a900cbc5e04a29e32d4549f25f08a7527

  • SHA512

    50624fc58acc7d16ec334dc90be40942f341e36ab1c2ffb890c1ffb99f293f0342b350b4c924b1bb58a0b5a5d2145c552d1ae8604ad669fb9d07747b3041efe0

  • SSDEEP

    1536:/O1ckwhbgljRyEjWV5s1jdoSfOUbfCPqpPI4zqkjJe67nIe6:jylBM8b7CipPXqkVXI

  Score

  4^/10

  discovery
  behavioral22

• • Target

    e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

  • Size

    293KB

  • MD5

    dbc292a2292c6061700236830d45ca91

  • SHA1

    fcdfba4b95c145a715209d694639de6be0478f6b

  • SHA256

    e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60

  • SHA512

    551e097fb31a5e7a6b6ecf602f7ae8cb63dc620940fe47b003ebcafcedbfdb391731cfce399b48111ee9524f2272f53eb4076c84f65e377336930fd6b3c3e0fe

  • SSDEEP

    6144:6qcbmoTtMUxxzP75a2eoEnnZcYupty6DPlQ82hmbN:6NTTyUX/5a2NGZcTs6DPlahmbN

  Score

  10^/10

  aspackv2discoverypersistence

  • Modifies WinLogon for persistence

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Drops file in System32 directory

  behavioral23