6a80416bed6371f82a05a001263458901b4bb81c59903e2882a9cd0ada10aa42

General

Target
6a80416bed6371f82a05a001263458901b4bb81c59903e2882a9cd0ada10aa42
Size 1.2MB
Sample260702-j251pscy2q
SHA256 6a80416bed6371f82a05a001263458901b4bb81c59903e2882a9cd0ada10aa42
MD5 ca5508d1a0355c79a424fec61c75dd1d
SHA1 930fb024f3709379a8c5c41fbeab151cea858ad6
SHA512 5c39dc7cf6e2033593f6432452a1901f07aabeae3b6b482b1cc2531750baef471c5c06c7b4cc0e03ac5e4a3b1202c92f871a391ca4baa573293c1fe0d950b313
SSDEEP 24576:x+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHOKjUoBw:x+yZW2IFJ8yRvk8i
TLSH
T185556C23E18184B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  6a80416bed6371f82a05a001263458901b4bb81c59903e2882a9cd0ada10aa42
- Size 1.2MB
- SHA256 6a80416bed6371f82a05a001263458901b4bb81c59903e2882a9cd0ada10aa42
- MD5 ca5508d1a0355c79a424fec61c75dd1d
- SHA1 930fb024f3709379a8c5c41fbeab151cea858ad6
- SHA512 5c39dc7cf6e2033593f6432452a1901f07aabeae3b6b482b1cc2531750baef471c5c06c7b4cc0e03ac5e4a3b1202c92f871a391ca4baa573293c1fe0d950b313
- SSDEEP 24576:x+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHOKjUoBw:x+yZW2IFJ8yRvk8i
- TLSH
  T185556C23E18184B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx
- Adds policy Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  .rdata
- Size 180KB
- SHA256 3efc88ec90c6318daa8b7898bab8e194d72af577a10f824b076d1d0b00d3a091
- MD5 30a46e79103d0f4e04576b3f527f44d1
- SHA1 78d30e75a16e96cf45cd3a4d85344938acdcc45e
- SHA512 5ce978b51c6072ab01f2e70ce1bfaa6cb9b54bf32388c5eaf3e13320d83b01d22697a946bfd96c6fa1ef8039dd28dc0530cfaf6e4036de5422c07ecd56d30235
- SSDEEP 3072:mUzxWxvRTrwNt7y9iOJNx+UWxTUT0BnXXxprYj/DHxKVWe1nk:+x6v76tgUoBrrYj/DRKX
- TLSH
  T13F044822B96AC1B3C0969030D6E75395E6A3F8014F224557728C573EFE23264973BBF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4