4b4d937412ce641fcc3545bf083912a6ca96f3dbe83cdc3146d439bc7403453a

General

Target
22768991078.zip
Size 721KB
Sample250706-tbzfca1jv5
SHA256 4b4d937412ce641fcc3545bf083912a6ca96f3dbe83cdc3146d439bc7403453a
MD5 4829ea45c8f5c964f811189a2703f610
SHA1 04e385edee680a70cde7fc6a809fbcb5cd41ca06
SHA512 cc088a879bd50348e18daf842f129f90e5aba48f1a3c56fcdb197a36023a69f04ab20b0125a61f918d6efac9a3bb8a38fbf9845cde263ec458b5303c772e8abe
SSDEEP 12288:KDNAo3yl74WUgdfU5Nzy4OnGmxj1ZLhIUObbWge1y2vLUpnELp4vS+wxrtd:Ks6OfUPBOnGoJPmWr1ySUlwxrtd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  8fdee53152ec985ffeeeda3d7a85852eb5c9902d2d480449421b4939b1904aad
- Size 723KB
- SHA256 8fdee53152ec985ffeeeda3d7a85852eb5c9902d2d480449421b4939b1904aad
- MD5 a71dbf2e20c04da134f8be86ca93a619
- SHA1 ed7c9fbd42605c790660df86b7ec325490f6d827
- SHA512 236dc10e754930f1bfec7397aa188b23720782ad8d801b7cd26aa6dac9b6883671c8cfe622ad212639fafee02fdc009bb2597b1ea51b6626f45c7ad0fa39df8d
- SSDEEP 12288:w0Or0wyGok7QkYOey0kD9WUysKjssPf2gFYJbGTNwFDYvEiF2nQ:w0OrQpRkYFw9gsKxX2uQzFsvwn
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer upx
- Disables service(s)
  defense_evasion execution
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (239) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Disables regular backups
  Uses wbadmin.exe to disable Windows backups.
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1