Extracted

Extracted

• • Target
    BitcoinWallet.exe
  • Size 30KB
  • SHA256 95ccdb851cc0ff41ad4b2c4bcf30ac26a94598cb6c8ceb5ea0e3f369c364199b
  • MD5 06ec38066562b24f1c92ad951216c5fa
  • SHA1 49e60c7c74014250ca4449dc3fcc5c7c520d6c61
  • SHA512 ccad1acdf5ec9564f6a4063a6196efdd5061f0656ac198b3fc00738389ef89b0599031dab92795b16d0554aced76a137f04046b7378026c66c6895ac55ec37b4
  • SSDEEP 768:yJioI+naoJPvoSnNnbDDFJQbQNLY6CBxw:uIymOnbDDEbv6Cw
  • TLSH
    T169D2E6007FECF916F1BE3A7469BA42044A73B4699936E75D1CCD60E907D3B409AC07BA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionransomwarespywarestealeradwarepersistence

  • Renames multiple (677) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2