d765f74af0a7e3986616b3018fd6190bd389458dcd408f208cb34072ef4eef12

Resubmissions

17/03/2025, 11:41

250317-ntvxzsskz2 7

25/01/2025, 05:21

250125-f17lcsyrbl 7

13/01/2025, 11:30

250113-nmm9kaspgm 10

12/01/2025, 22:38

250112-2kh4qasphw 10

Sharing

Copy URL

Twitter E-mail

General

Target

final.exe
Size

28.5MB
Sample

250113-nmm9kaspgm
MD5

0e8ac8c96394c6a523f41e10788dd32d
SHA1

f5d5e6f86f5f12d25d3813406239341e19e2f4b4
SHA256

d765f74af0a7e3986616b3018fd6190bd389458dcd408f208cb34072ef4eef12
SHA512

8a7ff55f0232fe1fbd4b860f82835cf7e1b7ce9d9bc6dcaad92670e811fa599fbb29b9d902db516d9c512a283168d0f71cfe458cd707d0553748adade954c7d4
SSDEEP

786432:S9Yidh5ngiRW8jjYEA8h1QtIea8DZcUTJl8+Q5++PbmSkytWx04MDIy:S9J5ngwWi8sviIv61ox+Sb5k8Wx04R

Score

10^/10

Malware Config

Targets

- Target
  
  final.exe
- Size
  
  28.5MB
- MD5
  
  0e8ac8c96394c6a523f41e10788dd32d
- SHA1
  
  f5d5e6f86f5f12d25d3813406239341e19e2f4b4
- SHA256
  
  d765f74af0a7e3986616b3018fd6190bd389458dcd408f208cb34072ef4eef12
- SHA512
  
  8a7ff55f0232fe1fbd4b860f82835cf7e1b7ce9d9bc6dcaad92670e811fa599fbb29b9d902db516d9c512a283168d0f71cfe458cd707d0553748adade954c7d4
- SSDEEP
  
  786432:S9Yidh5ngiRW8jjYEA8h1QtIea8DZcUTJl8+Q5++PbmSkytWx04MDIy:S9J5ngwWi8sviIv61ox+Sb5k8Wx04R
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation pyinstaller ransomware spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Disables cmd.exe use via registry modification
  evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9
- Target
  
  final.pyc
- Size
  
  5.2MB
- MD5
  
  0d007c76a8bbe73730f6e188346447fd
- SHA1
  
  c343652dda63ba68865696d857a37487895a3e0b
- SHA256
  
  a2bd3234742f1564f1bd3ec67ff0950b572af7684aa2e8229049cf7103f77dd4
- SHA512
  
  a30c5954dc7a46526fe3173581986f9118ae93872b4d04d4cfc4431ccd021896183712c6eae1fdf79e06b0e2f9983d8aca3bcedb6536a469e9694cd42330a4df
- SSDEEP
  
  384:D/bhUjvug7MB5zpQiig/li+RvkDj1ZYIbv4cUcrvE/QwkRj6ARwGDOHd/0xF2JD5:D/P5
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral20