Extracted

Extracted

• • Target
    sub_6d4e75bc0cc0.bin
  • Size 1.2MB
  • SHA256 6d4e75bc0cc095fef94b9d98a4e94ce9145890b435012b5624aa73621ba6e312
  • MD5 d470bb8d97ce5d663ff251bf72f4fc92
  • SHA1 f4e616e2aebff743b899a49a126282370c581212
  • SHA512 8c1c4fdc73188a52b9166517c64ab5b670953400f75d67a5f9028e4f173002dd757db8123c6d22603b9c35b0881c538e909e75bce10146a4276b2ac63343ed95
  • SSDEEP 24576:h88lWqXTOlAiZLkk7g9WWYNranPdeDk7bE0KdYqTAp:hTl3XTOl6ag90cPdX/Ad9TA
  • TLSH
    T10855332AD712E8A5F34B84BD747C9F990824B4E8C4AC7A57473F4D2365735E2A0CC9E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutioncrytoximpactpersistenceransomwarestealerupx

  • Family: Crytox

    Crytox is a ransomware that has been active since 2020.

    ransomwarecrytox

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (14065) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2