General
-
Target
solara.exe
-
Size
5.0MB
-
Sample
250223-b9ybtswky5
-
MD5
490c2bb3790ac4202ab4ba700e2058a7
-
SHA1
25de62792ba828dab9e74edf121bdf8e8ff0f0f2
-
SHA256
d1a7c1e5ecdc4376b07913434048d2625def43e46504715a7a6600505319ad51
-
SHA512
59fecb83e64abdc5da339cb1506832418ccf99d5c0bf5c46e2359b7f4674381784e3d621df0bebc107e17d728c8ec6ba672f5e5e88a7183c562541bb7a56d1bf
-
SSDEEP
98304:FtNUK2yL5IrA3ocpcRDL+O14UndAtax4bmtQHgNByxuq4aX7lvECX+e0+Y:FzU5yt53oUIX+ggtax4bKQHgN/arpE4+
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Documents\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Extracted
Path
C:\DECRYPT-FILES.html
Ransom Note
<html>
<head>
<script>
function CopyToClipboard(containerid) {
if (document.selection) {
var range = document.body.createTextRange();
range.moveToElementText(document.getElementById(containerid));
range.select().createTextRange();
document.execCommand("copy");
} else if (window.getSelection) {
var range = document.createRange();
range.selectNode(document.getElementById(containerid));
window.getSelection().addRange(range);
document.execCommand("copy");
alert("Base64 copied into the clipboard!")
}
}
</script>
<style>
html{ margin:0; padding:0; width:100%; height:100%; }
body { background: #000000; color: #ececec; font-family: Consolas };
.tooltip {
position: relative;
display: inline-block;
border-bottom: 1px dotted black;
}
.tooltip .tooltiptext {
visibility: hidden;
width: 120px;
background-color: #555;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5 px 0;
position: absolute;
z-index: 1;
bottom: 125%;
left: 50%;
margin-left: -60px;
opacity: 0;
transition: opacity 0.3s;
}
.tooltip .tooltiptext::after {
content: "";
position: absolute;
top: 100%;
left: 50%;
margin-left: -5px;
border-width: 5px;
border-style: solid;
border-color: #555 transparent transparent transparent;
}
.tooltip:hover .tooltiptext {
visibility: visible;
opacity: 1;
}
p#base64{
-ms-word-break: break-all;
word-break: break-all;
-webkit-hyphens: auto;
-moz-hyphens: auto;
-ms-hyphens: auto;
hyphens: auto;
}
p#base64:hover{
cursor: hand;
}
</style>
</head>
<body>
<table style="position: absolute;" width="100%">
<tr>
<td style="width: 25%;">
<td style="width: 50%;">
<div style="text-align: center; font-size: 20px;">
<p><b>Maze ransomware</b></p>
<p>*********************************************************************************************************************</p>
<p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p>
<p>*********************************************************************************************************************</p>
</div>
<div style="text-align: center; font-size: 18px;">
<p><b>What is going on?</b><br>Your files have been encrypted using strong reliable algorithms RSA-2048 and ChaCha20 with an unique private key for your system</p>
<p>You can read more about this cryptosystem here: <a href=https://en.wikipedia.org/wiki/RSA_(cryptosystem)>https://en.wikipedia.org/wiki/RSA_(cryptosystem)</a></p>
<p>The only way to recover (decrypt) your files is to buy decryptor with the unique private key</p>
<p><u>Attention! Only we can recover your files! If someone tell you that he can do this, kindly ask him to proof!</u></p>
<p>By us you can decrypt one of your files for free as a proof of work that we have the method to decrypt the rest of your data.</p>
<p>In order to either buy the private key or make test decryption contact us via email: <br> <u><b>Main e-mail: [email protected]<br>Reserve e-mail: [email protected]</b></u>
<p>Remember to hurry up as email address may not be available for very long as soon as law enforcements of different countries always trying to seize emails used in ransom companies
<p>If you are willing to pay but you are not sure knock us and we will save your e-mail address. In case the listed addresses are seized we will write you from the new one</p>
<p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p>
<p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p>
<p>Base64: </p>
</div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">qx/IqrO2vBDv5aha2sadrM6T3Eq3WidzNh02vJLfx+3R5l2DkNBx9d1ujlPBngQOPoOtWOiv+ZAT4SjE2rwJ2+SxTB/daljCWkllBxfR/eziS0QfJdJykGxSDkT2EqIwU3BSAMQf1hvZOIWzqccj2KnkrCSbFDD71PRbTtRriiVtojBr3wZNEQNK9+Ct8YI4vjaYLY8vcRouSu2Z8LZV4GQgDj7JocdBIdD4czByJ4uecATO186B/q3L+6HMYPYUnIv80w14jo+Yu9s9xtGMlnymXBLo0hALmmoF4yuUCpMjZ/qJgKQyK3PcX4xsJ6UyCyu//7wuM8SAam9n7cZda8SVarnTH/JILYBhnpYxSQLqKGlDMGjwgXEUJYy+0syxgQzd2ksTYXSdpxOxazpXfVHc7IcJ1/c5Q0mWOG0s1yroGVp6bPlclQ0vmCLOOg0BHxyoFqesQWZIz8z48h2Gwo2O2PzrUU4vWyDudDU78dadJntwZDpfk3guMv0b/AthoubhnHXR+sajHqtYH8oJNwOmEHOfD5U6Ig7/rLgnvKwvRdth2AMQlO82KO6E6CHLmm+l3g836RZw/9gkdxdZGyRz/KabvahWNtqf6OB5YE44b1AetJgZCbPsoDM4D/905hnOelp+EFnNAPkwWcRhjolqzRZkdLgD5JKVMXzs7IYAIKRmaLGkZ2nha+6IaKDi7tLaEtQHsZTlIOY4014FcrtzmR67afI0Vhu3uyKMOXgwiAAYNJ3rP7awbn2GiAEoK09WSHfK601qTGJbf08xIXBEeDL7gXizIkt1WZUqxG0eMObOxcQIqf+dlZuar7OQiNyDfRBw+VY4maQgCVIKSnup2VGf1JAPIIhVaBFgQPFjxVBBUCDz6irGCeJzpfIvFHn72O8L+BQTPze+QuVSb+s2ZvoTpz04tEp7NGBc39B7N+CK4qGlm4+cya+4Nqn/8WN8UOO1niap6sK4a1MSGh1a0IBvcLgPSYVMUbZiImIWR/FLqOyDQnTT8UvFmdMYyMA+XcjQRsKNz5GkvWbrdB7S02mjfJIQLx3IPMpi9rP1nTurdI7Pl+LAj5DczHaNMWKNYNUtYfPR2Sy/wVXYTZVtBpAVnsCIeTadP6HDiiIgZ6/1SJmSZL9ZN06ySIefAHrdLtZLBqwwnzAhvyyvpOH4HrdQQNQbKo7ha9CdsuwR0TChjtCMnqEaZxmCOFEHo3pZXgOCv5LfQ1W/ZwxLEk3Z1eLD4w+MSbl8N3O88OKE7Pl02R0/QNEKpDxOG0L5YP23XF6sES7JfwgwBhPSMSen9Ypy0dlR1hcpdGPQN59Car+vydZziPppnOcFZrcuIhvdPQ4ndGD65EAaz2muIIEUFZ/j71ndtcujXSOHHFBfWLKoHFrMp1pWw8/N4E7wedw4fffodGNKxgf9ygWtQXsMhm2zmJjQ5yoFRsTe82vI7pCGDVJAkrDQi3llfq6oVunwBOQcodRGYsuWA6JkM4aRZocZHMggtGCwC+w1eTPx//F16GE7tWYs7hpJG1IrX4qg/ZDUOAII3iyKHKYnTQoZBaf2xyqe1KcNboVgnap4OjAZhqpRXvmGZM+INRBUD8BtZPxUsBOcHdpqDIdSRxHjyP4UkfvQagGpP/KR8i/F3w9xD/fTyUIo6oiaiLOJiw24qUDsanEMg7ZJpyVE3/ZvtwA4pQDbrgdV4021P64knRYwOkFSyijaMNOOAy7dd0rtS6VQZYzWOqLF5wjQeIIVfSUhGa3GhplEjH5t6iufh1BrctPTbMrH7hZ5K3ABlqZOMDozTBmymhR4OK2tSdLhOltJLYp5ME99ZNgWNxrcJREVEJntqrPlx+k9eVvys+IkxdLqaVfgEL6OoB9EXnJ8Ni+fgJ/RPax98uHl7f2ozQ/LdmnYVpKNBJpWRcHCiL9cIGKU9WTxY9P4mnjccEe/Kh4trQYfhHBXe4RLUAYkPVDv8HsIduIRlygP8+pqU4c/TXR5J3Hk0CGRH6QZPs+b/dknt2mDFMYJSyjVbPTifz4gXkejUhgLRRQISh+usk5/tgg7aU1bfaWIU+09ntVYjbbGeZfQkfPmFDwPO4C+AV1DltoGiGz82nP5f49VOREUiecbiu4GXSWCIWQgGYbmioMNlt2JvjODN0yJ0Sz9RFqgNXEmfHe5/ZTGJ3DC96f9RZ3DlLsp9Vhw04hR/f6sJiPnOkhMm+YnjSxKkZCxPxJoYD24f5m9PRAKYy6GjO2/HwoiOAA2ADgAYwAwADkANwA4AGQANwAxADcAYwBjAGEAMwAAABCAYBoMQQBkAG0AaQBuAAAAIhJDAEMASgBCAFYAVABHAFEAAAAqDG4AbwBuAGUAfAAAADImVwBpAG4AZABvAHcAcwAgADcAIABVAGwAdABpAG0AYQB0AGUAAABCVnwAQwBfAEYAXwAyADAANgA0ADcALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAAzADgAOQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHClrt17eAOAAQKKAQUxLjAuMg==<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"></tr></table></body></html>
Emails
[email protected]<br>Reserve
[email protected]</b></u>
Extracted
Path
C:\Program Files\instructions_read_me.txt
Family
blackbasta
Ransom Note
ATTENTION!
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: 7ab0444a-f73c-4ab0-b3a9-4c2ead84ecf1
*!* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
*!* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.
URLs
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Extracted
Path
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Extracted
Path
C:\DECRYPT-FILES.html
Ransom Note
<html>
<head>
<script>
function CopyToClipboard(containerid) {
if (document.selection) {
var range = document.body.createTextRange();
range.moveToElementText(document.getElementById(containerid));
range.select().createTextRange();
document.execCommand("copy");
} else if (window.getSelection) {
var range = document.createRange();
range.selectNode(document.getElementById(containerid));
window.getSelection().addRange(range);
document.execCommand("copy");
alert("Base64 copied into the clipboard!")
}
}
</script>
<style>
html{ margin:0; padding:0; width:100%; height:100%; }
body { background: #000000; color: #ececec; font-family: Consolas };
.tooltip {
position: relative;
display: inline-block;
border-bottom: 1px dotted black;
}
.tooltip .tooltiptext {
visibility: hidden;
width: 120px;
background-color: #555;
color: #fff;
text-align: center;
border-radius: 6px;
padding: 5 px 0;
position: absolute;
z-index: 1;
bottom: 125%;
left: 50%;
margin-left: -60px;
opacity: 0;
transition: opacity 0.3s;
}
.tooltip .tooltiptext::after {
content: "";
position: absolute;
top: 100%;
left: 50%;
margin-left: -5px;
border-width: 5px;
border-style: solid;
border-color: #555 transparent transparent transparent;
}
.tooltip:hover .tooltiptext {
visibility: visible;
opacity: 1;
}
p#base64{
-ms-word-break: break-all;
word-break: break-all;
-webkit-hyphens: auto;
-moz-hyphens: auto;
-ms-hyphens: auto;
hyphens: auto;
}
p#base64:hover{
cursor: hand;
}
</style>
</head>
<body>
<table style="position: absolute;" width="100%">
<tr>
<td style="width: 25%;">
<td style="width: 50%;">
<div style="text-align: center; font-size: 20px;">
<p><b>Maze ransomware</b></p>
<p>*********************************************************************************************************************</p>
<p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p>
<p>*********************************************************************************************************************</p>
</div>
<div style="text-align: center; font-size: 18px;">
<p><b>What is going on?</b><br>Your files have been encrypted using strong reliable algorithms RSA-2048 and ChaCha20 with an unique private key for your system</p>
<p>You can read more about this cryptosystem here: <a href=https://en.wikipedia.org/wiki/RSA_(cryptosystem)>https://en.wikipedia.org/wiki/RSA_(cryptosystem)</a></p>
<p>The only way to recover (decrypt) your files is to buy decryptor with the unique private key</p>
<p><u>Attention! Only we can recover your files! If someone tell you that he can do this, kindly ask him to proof!</u></p>
<p>By us you can decrypt one of your files for free as a proof of work that we have the method to decrypt the rest of your data.</p>
<p>In order to either buy the private key or make test decryption contact us via email: <br> <u><b>Main e-mail: [email protected]<br>Reserve e-mail: [email protected]</b></u>
<p>Remember to hurry up as email address may not be available for very long as soon as law enforcements of different countries always trying to seize emails used in ransom companies
<p>If you are willing to pay but you are not sure knock us and we will save your e-mail address. In case the listed addresses are seized we will write you from the new one</p>
<p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p>
<p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p>
<p>Base64: </p>
</div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">Pq1i/Lr1tfg6yHIpxvToFcwbjeo01yMTHfVolYw+UldRVdxdVuQOp9Xilnfa3b4FVUcNaBFAz1ixx+4LluBmxA0p8uoqvf6bjPGRtKcfXBk/f7dyjXCu6hxjWnZUVZtljwLZ5Zpp1T8ScszHqTGBUbyNYHTnLWkivcQmj4ADj7j8S6dvdXJn1YVaFkapHwQfqqJzzClLOLDQ4n6Q30y3cFRAEmsQ0ER/tWXWWnwg5Uepawr3e1ddZrT6cCS8nqotfJRli0WeQHU5EYOjtLZ9tOrjDE+0bFoiLzAlOKtYVLsQ9fwketZ5c75LgKmiBs0U9I+pxlkWwvoZaFxV9EnaUUPIFZXDbAS9bnDJEXZ4RnYFQ5gqzbUJUAm3Lq96brnJuDmADrEZUmULmOdkbUXe4oeAAofUM7B0W0u2WAeK/Xvp1tEDpGZheE2qJh+Dbye110dUv95ZEKW66ZHQFjg4Llm1qKADFQKWidNzFdvMjnXihk6gsCdKwwu9CZ0EsTJXPKzY/KKfiGPt2Ww27yJdJpDzATxMqLnoCxMI6dIHlgzQhQ6qqWn7ZtUH3PUPSZVF788x0Qkx9JrR+gOkScvHnjfFhz8cHPWeMmTZxSzCVpXWWyjftehtm9qlpq7b0xeqjEqa+VD/HXcNZfs9fxRxPfqFO2vKrkuxpwpQp2E1nSxGrhqrsnlOZarPI+ptTntS/YV11r3MZRx633J0gBYfZOSUJwB6V4XteOKibrOgKGOcae/Ogj8t1ewf4f7svLXwd6ZkyrdCiBtkjbQSoQm7RuRja29/iy3QAdE5y2rdaXYBxnJTzX4u7vDsLbMAyAIYrXwPGUbK9k95v/VmnBdFe8DdZwWcopLe+pPJqTpubWA0zqUe9XP+9I9dIzfjReEGO2HjtHJA1W6mUFNrRETx2S/HmH9aTL2IuuLISrCh4M/IcZePnndT8OyE8rwpBMDciGJGgBvA1svaJamklA/ncGrGDLpyvC2Mtmhjtg2UB0n4tLfSd/DOrzjoLXys7en3enB6TpTPJ2/5z3QnBlZxEwNy+C2jRoqR5BwbFKfoYL/m7q/rjfUcA2nUO1pOhDwJjXK3MW/s5DECpUAc2TE5BQgLF9Cp94fPc4AVehGPJr42iUP0jmUO7ZryQMmjWNaGs+LDFLZ59XtSeus8cNG6wQiR/1YASCfdG+36YhZ0oXkVtMfRgVfx0h16duDbAYy0oFdAWfEAciCSI2Pz9FH/yoHtdHKl11xHbb4JScsD7RuWEho2PGZawK9eMM6l9ponLe8F8IiIf0V79xDkj20VLR/3w+xcY7zv12kMCcV3qbmW2edtmW34QLp4LqQkehM2cJDH3xFCgdQeDw48n0Wo616zyW6p+mQ3dV6PSfu/A0x0s69HDPZxhAlgJ5qjVPD3XPbso71ZQAfxZd8IczhPr7+o+pwaZgtZ6LQPdLZ3jaC2jc7a5TlWOaOJYr7/TkRT9VMMsATPgyKRS6J+v+1WSKHAAOyc5dGqrwjsLWa8i5WqYpZmLFqz3knRvuNB5d3zfOjlxNscQUIYIMs5srhMS1+UPq2IH41p0ZV72/nfkhnnrCH1Iqupn2Lr4Ewl9PIHZYGRD5JoMuxO+xfN+y5YZotA+dfRFESMI4xQAXrRp0mXZ16GA6TvJAxqQPQMgKyCMkcRNQ3DAx9+TTXpYUhpm9grYnObnuFUBcn8gWqsOtaYnLceR9svon36/VQgak9LMSuE4ecof2Ih2YiBVXJINfVLNTM1VyvHRK2Bd4Cwwv9xGGAJaIrDAJhQyG7eQOQ/ZaD08A/EFFE6JkOYiqNcguoBmeIE7nSBd5g++99m7p4k/RYH0lvgL5z+vaoj5Nn7V74dXGALuflj+cfUZHpdnTIk5j9YjZBwCQ4i/iuihZmQvmbVkt8K2CK+MI9t7dY+MLNhjwVUy+Wj+FJvfMfYI/wO3+pAtA4gRmxg4O/aeG4qZbaQxYDaOmdKvOekxxcrB24eppZ0TcQsVcjVLGa761kYoj7UFhTudKbX2VVZp/wdxuyr2yqcg3hCTAndn+3mfQ1cVkJ8zBH88s7Q/Ztr1yb83y9joIQJ9uP3cuPVkLL0TGYOpRTSKlNfdRhdSjhfuSn/VNTjwJsVO4Jn7g7dtyL2JI6X1QuW6kHqHdYArdq94IuN1KzmmAJ20xZGqrWFbRueQJ/z3mkF57Yaai6+yfWZsgDY1zDnnEFj9Y7ltqEZny7kAHw0ppNeWhJoo6Vn7RWqIgoiOAA4AGQAYwAwADkAYgA0AGQAMgAxAGMAYQA2ADAANAAAABCAYBoMQQBkAG0AaQBuAAAAIhJDAFIAWQBXAEwAVQBWAFQAAAAqDG4AbwBuAGUAfAAAADIsVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAAABCVnwAQwBfAEYAXwAyADAANQA2ADcALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAA0ADIAMQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHCGseVyeAOAAQKKAQUxLjAuMg==<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"></tr></table></body></html>
Emails
[email protected]<br>Reserve
[email protected]</b></u>
Targets
-
-
Target
solara.exe
-
Size
5.0MB
-
MD5
490c2bb3790ac4202ab4ba700e2058a7
-
SHA1
25de62792ba828dab9e74edf121bdf8e8ff0f0f2
-
SHA256
d1a7c1e5ecdc4376b07913434048d2625def43e46504715a7a6600505319ad51
-
SHA512
59fecb83e64abdc5da339cb1506832418ccf99d5c0bf5c46e2359b7f4674381784e3d621df0bebc107e17d728c8ec6ba672f5e5e88a7183c562541bb7a56d1bf
-
SSDEEP
98304:FtNUK2yL5IrA3ocpcRDL+O14UndAtax4bmtQHgNByxuq4aX7lvECX+e0+Y:FzU5yt53oUIX+ggtax4bKQHgN/arpE4+
Score10/10-
Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Blackbasta family
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Indicator Removal
2File Deletion
2Modify Registry
2Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1