hiddentear | 64707769579ec19306dd3e0882ff518f781777b5c748c848165f089ff11e544e

General

Target
DREDGE.exe
Size 626KB
Sample260623-fnzd8aat4p
SHA256 64707769579ec19306dd3e0882ff518f781777b5c748c848165f089ff11e544e
MD5 32c3c8c2a30047c9cb3cd2aec4fe4a5e
SHA1 1e4f9907b29f52f87e829aed2328dc1edfd3f56f
SHA512 6da51f6e7de57232e29e80fcaec6a9ae72635fdad68a5b27b9f61078b80b9bdc9798285cbc3fc4c25b3f3fd459222847ec6dec6f464014d04298331b011b1ba4
SSDEEP 3072:BdyL7bYnm6oGq3gCWtutYFnsz0F6IzCJWgcvcCNvgSc5CvCtNAxxlcs:BdY0qgutYFovggcVNvgSx2NAx/cs
TLSH
T177D45C937680CC62EA311AB18425DAB94B3F7DA46E319A1B65E6BC773F313C31C16817
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  DREDGE.exe
- Size 626KB
- SHA256 64707769579ec19306dd3e0882ff518f781777b5c748c848165f089ff11e544e
- MD5 32c3c8c2a30047c9cb3cd2aec4fe4a5e
- SHA1 1e4f9907b29f52f87e829aed2328dc1edfd3f56f
- SHA512 6da51f6e7de57232e29e80fcaec6a9ae72635fdad68a5b27b9f61078b80b9bdc9798285cbc3fc4c25b3f3fd459222847ec6dec6f464014d04298331b011b1ba4
- SSDEEP 3072:BdyL7bYnm6oGq3gCWtutYFnsz0F6IzCJWgcvcCNvgSc5CvCtNAxxlcs:BdY0qgutYFovggcVNvgSx2NAx/cs
- TLSH
  T177D45C937680CC62EA311AB18425DAB94B3F7DA46E319A1B65E6BC773F313C31C16817
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution hiddentear impact persistence privilege_escalation ransomware trojan adware spyware
- Detects HiddenTear Ransomware
- Family: HiddenTear, Cryptear
  HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
  ransomware hiddentear
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2