Extracted

Extracted

• • Target
    2025-12-17_728366bfceae22c97409382e32c0ce8a_elex_glassworm_luca-stealer_medusalocker_njrat_remcos
  • Size 707KB
  • SHA256 ad9bcd0ce64903642e5e505145c2c1edbf0849493b105c62e8bd3b636bd0374c
  • MD5 728366bfceae22c97409382e32c0ce8a
  • SHA1 967de344400acbb947c472c26bdc500c378ac2f9
  • SHA512 7aea2a21e035faf73d62680d2e1f50fc606237060328e5825373f6ec944d048689f0fddf9b17c00c7aa6d1065d45fd4f0dec45060f59d6354bca4ed668a2eb63
  • SSDEEP 6144:PcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1LOFvDh:DuaTmkZJ+naie5OTamgEoKxLWQth
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionblackhuntimpactpersistenceransomwaretrojan

  • BlackHunt Ransomware

    BlackHunt is a ransomware.

    ransomwareblackhunt

  • Blackhunt family

    blackhunt

  • Deletes NTFS Change Journal

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (3365) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2