50ce8538ad3fbae1449bb7c6e7fb4a8d593dad5c87e2a1f332aaa80ce459ef64

General

Target
50ce8538ad3fbae1449bb7c6e7fb4a8d593dad5c87e2a1f332aaa80ce459ef64.exe
Size 558KB
Sample251208-s3dsaazjdr
SHA256 50ce8538ad3fbae1449bb7c6e7fb4a8d593dad5c87e2a1f332aaa80ce459ef64
MD5 9ab4602326beb927310c89572053fa43
SHA1 c806e583ae7972d5f1669636a5b778e5542b1584
SHA512 4e24506da423c3548aa4f8b52412ab539745558738bab54cd232d2601f310b925a6c15cba8520608b2f1c0e5736c67982819e04ff0dde42ab96a6196b6334de6
SSDEEP 12288:m68ne9z+D7kCXN1SZoenpHHzGK+/wqvJxkfUEpOEfea6NKyfQ:mkz+DDK1nNGK+IAJxkfziPY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  50ce8538ad3fbae1449bb7c6e7fb4a8d593dad5c87e2a1f332aaa80ce459ef64.exe
- Size 558KB
- SHA256 50ce8538ad3fbae1449bb7c6e7fb4a8d593dad5c87e2a1f332aaa80ce459ef64
- MD5 9ab4602326beb927310c89572053fa43
- SHA1 c806e583ae7972d5f1669636a5b778e5542b1584
- SHA512 4e24506da423c3548aa4f8b52412ab539745558738bab54cd232d2601f310b925a6c15cba8520608b2f1c0e5736c67982819e04ff0dde42ab96a6196b6334de6
- SSDEEP 12288:m68ne9z+D7kCXN1SZoenpHHzGK+/wqvJxkfUEpOEfea6NKyfQ:mkz+DDK1nNGK+IAJxkfziPY
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 938580b466533dfa1461e9858fd106b60e1a52b713380915cc03afd3e4b4573c
- MD5 98bdb37511634dad8d1236d91d373b26
- SHA1 778cf74b4f8860cc378fa4e61aeba318197783ce
- SHA512 5a7a903c2346750f20c0b41ceb6259bc7a5c9c6779acfeef94e0cea756aebabef58fdd83389353a165530279ec74ff20b903fc9a11acf475ef9471bd5e8d140e
- SSDEEP 96:CjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkND3m+s:nbogRtJzTlNR8qD85uGgmkNK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Crazies113.Bun
- Size 53KB
- SHA256 4c058130442426e8d7c1c57961f1bab0a35d786004ff63cf6774eac3b7ce4a01
- MD5 b64d4f3843ae879282da46d2e5970c9c
- SHA1 9af6d4c28161c7a08c83424a78d8e25604a3ef26
- SHA512 9910d9e966e144b5f836a86b699aed4034bc926dbb8efdcca1b6f0bb03ab44dd75719c250521fd45c2335dd933a08be7a4264e05efcffc375badfbcf81c78526
- SSDEEP 1536:nAduf2xXidEEltemvac1GwYDZtpyO3rgOZ:nypxiuEltemvJgLDZD9g0
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

execution persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6