005d0acad4b988b933bc58b249238a601d4a6104324db85fa9a67bc29c57abda

Sharing

Copy URL

Twitter E-mail

General

Target

Windows11DebloaterV205.zip
Size

2.4MB
Sample

250330-xmglfsvsdw
MD5

82309f098231e69aca97e5e1ba0e9fc1
SHA1

503fd3774de810d1836e3581c80bf3d4dc4d76a2
SHA256

005d0acad4b988b933bc58b249238a601d4a6104324db85fa9a67bc29c57abda
SHA512

fa4abd26cb7458198b5fd740077837d97fe8af1af5e843d050947fc37d22b8332a23c9db20ac71b235f4e17f4484870d386db35200ed5bc09d42ec1d37d00f6d
SSDEEP

49152:drM62mbt6e+A5rOToQpqmtEtY68xdSLUQ21mkrp42L/bdsFPAeyTuYJ:d92mrSsQ7+qbxdkUQ2P42LTytAeyTu+

Score

10^/10

Malware Config

Targets

- Target
  
  Windows11DebloaterV205/Config/advanceddebloater/advanceddebloater.txt
- Size
  
  33KB
- MD5
  
  ed4f7322de8ddf560bbe7d83d62b2ea7
- SHA1
  
  5a84667c371edd7640c1e3580a8f6ac5e4a00d63
- SHA256
  
  0835a0e8cf1cc013fa9243061a166d532567f7b697b18bf31e6d50e1fae962f4
- SHA512
  
  6fe06302dec800c0ebb5657e9fc33f912487591fa41147adbae3c99f7a10d1b75b87ae80115e499e863df16c96b8bf7bf1bdbc3b6cbc503c48d1de11cede391b
- SSDEEP
  
  768:3tXZRI44RuTzhU4E7bqyDKHezhz8gWOTDDOxIo7Uq0eZa6FWZc:3YxKHezR+
Score

10^/10

defense_evasion discovery evasion execution ransomware
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies file permissions
  discovery
behavioral1 behavioral2
- Target
  
  Windows11DebloaterV205/Config/extra/fixwinget.ps1
- Size
  
  380B
- MD5
  
  0eb36f54ea10b8aff0b0b356dea7b311
- SHA1
  
  9180974137c6627e5ea9dd3eccdc06136c865421
- SHA256
  
  28d3862f1c96fdd6c08639f126786c1b8d2f183d983e8911a7bd3a1e875e02b2
- SHA512
  
  9a0bf6ed11a933b96362b66f26f5ceffc46bf995c74a212387f4a632a8f2673497621cce01c5bdf87e0f902275c38d62d86fd5042d1a5079eed6849293ae8cf3
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  Windows11DebloaterV205/Config/ezdebloater/ezdebloater.txt
- Size
  
  52KB
- MD5
  
  e00cf4301db40d49990672255a164eb2
- SHA1
  
  32ec132aa7825535bd70f1c6c284f707db08c181
- SHA256
  
  6456d8389910e5e584bafad8aca74d1c228acdeafc194a552232cd5039fc3980
- SHA512
  
  749b95809afcc88ef92da1551a388085f39f5892d5722655a6d36724ed734814692ac26cd828c19404f995ce06a65cddefcbf27d6eaf391fe83ae133171bafe4
- SSDEEP
  
  1536:3YxKHezR4N0RUxBZA3bz8gNE6yu0xFD2N8:3Yxbl4N0ORA3bz8gnyu0xFD2N8
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Modifies file permissions
  discovery
behavioral5 behavioral6
- Target
  
  Windows11DebloaterV205/Config/finetuningdebloater/functions.txt
- Size
  
  220KB
- MD5
  
  996a40f0c897768615ed2982ad3338bb
- SHA1
  
  cea4d41a96c76ca8499184e5a9fae4f4b806ff3f
- SHA256
  
  0752bf2415078575b2763fcb6fea8e0698320851fee6c78e30d0a68f2ae0d6db
- SHA512
  
  15415be614eaee6b349a4292cf3563f6ab942d82c5c96492992a011c11e7f6cd7436b999850a4020ed467353f92e12a59c9eec7d27e8670ce429c8d9ad7f132e
- SSDEEP
  
  6144:DIkQ8S0en3z+wuRm/Nzg9/aEUkjX87fe4TIfDYQYj:zQ8S0en3z+CEUk47fe4TIfDYQYj
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  Windows11DebloaterV205/Windows11Debloater.exe
- Size
  
  2.2MB
- MD5
  
  f0dfa157e77657bdd637be327450e4d7
- SHA1
  
  909c7b789ee52c06cd1978e18eeea82de476cea9
- SHA256
  
  aab7fbb655987d0bc2317429124aaa2b3a099c8173db787e9631de9563c78be6
- SHA512
  
  6b2b4b60d3488ffd57363ac2c3a3c226184557f98ae8ca32981ef03551c3c88874e0726fc2b65859411e72869e0bc422cbe81880d2068a5b93917a99ef60362d
- SSDEEP
  
  49152:olM2TdJp+mtE/eQJO3Wdgtn9VgbtKWTLHqEXCm4eH:olM2pJ3+GQJOZtn9cKWTLKEXCm
Score

1^/10
behavioral10 behavioral9