b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483

General

Target
LetsVPN.exe
Size 30.4MB
Sample260701-repdfahz2y
SHA256 b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483
MD5 b08bef15760d186eaa84d7d841498479
SHA1 5bc427ec099e18056e052e57be56627158028323
SHA512 03d04394170ad4d0826ec164d04285100635f0744573ca745d246255a5b1268c9b8df6e9f89804acf38395fdc2309d937483b3c76892b1be09dd6f3ef6dad2b6
SSDEEP 786432:Tt/o9kq4o2+gfnzPE3dLVjI/J+wjIqFOtC3/6eJD:e4o2DzPKFgOqFOAvjJD
TLSH
T1EB671221F24AC13BE56901B1592D9A9F5129BF7A0B7140C7B3DC3E7E2BB54C21236E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  LetsVPN.exe
- Size 30.4MB
- SHA256 b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483
- MD5 b08bef15760d186eaa84d7d841498479
- SHA1 5bc427ec099e18056e052e57be56627158028323
- SHA512 03d04394170ad4d0826ec164d04285100635f0744573ca745d246255a5b1268c9b8df6e9f89804acf38395fdc2309d937483b3c76892b1be09dd6f3ef6dad2b6
- SSDEEP 786432:Tt/o9kq4o2+gfnzPE3dLVjI/J+wjIqFOtC3/6eJD:e4o2DzPKFgOqFOAvjJD
- TLSH
  T1EB671221F24AC13BE56901B1592D9A9F5129BF7A0B7140C7B3DC3E7E2BB54C21236E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan adware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2