9c014a0c017beaf62167900b04351b022a1806ea85a7300144dd2817d3a9f2b3

General

Target
IAteMushrooms-v1.6.24.exe
Size 2.6MB
Sample260621-kchdsact3l
SHA256 9c014a0c017beaf62167900b04351b022a1806ea85a7300144dd2817d3a9f2b3
MD5 0a0e572656d2f571fe4515bda6a0d896
SHA1 25db6fa69cc5a2ebeb2af214add1b0c7ed17ae72
SHA512 2165a7a5cf2045a5b2ac668538b8a394bffd7104c377f1d64470c5fb9a8c5fe65ad6eb3657626df10797af0f9500490cbe09712087bd8d5bb065ee9b820419ee
SSDEEP 49152:98TafIIi3GJUDN8p8JgOAbovb2cFKZlOSEqkCaWT1NuX900gtmqSFcykk:98T80oiN8plOBbtKnOmbVaCm3Fc8
TLSH
T1FEC533022B42D85FD2CA273413B5893EE3A69C6C79D13F872F11FA89A431215FAED255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  IAteMushrooms-v1.6.24.exe
- Size 2.6MB
- SHA256 9c014a0c017beaf62167900b04351b022a1806ea85a7300144dd2817d3a9f2b3
- MD5 0a0e572656d2f571fe4515bda6a0d896
- SHA1 25db6fa69cc5a2ebeb2af214add1b0c7ed17ae72
- SHA512 2165a7a5cf2045a5b2ac668538b8a394bffd7104c377f1d64470c5fb9a8c5fe65ad6eb3657626df10797af0f9500490cbe09712087bd8d5bb065ee9b820419ee
- SSDEEP 49152:98TafIIi3GJUDN8p8JgOAbovb2cFKZlOSEqkCaWT1NuX900gtmqSFcykk:98T80oiN8plOBbtKnOmbVaCm3Fc8
- TLSH
  T1FEC533022B42D85FD2CA273413B5893EE3A69C6C79D13F872F11FA89A431215FAED255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/NScurl.dll
- Size 3.7MB
- SHA256 1f3ffe4e41193b2c98edbb0726cf9ac6102a8e2346a1485788e1b83e99407995
- MD5 b92b00bde182c750feea85f03fcab8a4
- SHA1 6323082464a9559885d9b637dd666f2cb8018bff
- SHA512 e8be32fdf1478863da014e7040fd3b8fa4ea3e5055cabab47f4f8296c93a0ae00dc82be2b23ae9e2371b3ebc0d2da13b51edb0705dd779c710b5a4720acfd8ca
- SSDEEP 98304:deOVpO6zhYO6Q3KfJm4Qwj9gxWnsYeyxLnf5si73oFUPqpDx:deOPO6zhYO6YKfJm4QwjKQ7rxbf5h73i
- TLSH
  T1D9063994FECB00F5E55398F0F49BB37F873096054025EABAFE485E26F933745261A21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- TLSH
  T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
- MD5 b4579bc396ace8cafd9e825ff63fe244
- SHA1 32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
- SHA512 3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a
- SSDEEP 96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
- TLSH
  T171E1093571C02DF7D08D89743816BD2F43F4D52627BE05A04A7B1AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5