Extracted

Extracted

• • Target
    nCoreLauncher-Setup.exe
  • Size 358KB
  • SHA256 ddebbc1ab1fc10722c35e5e18072ffa888dd39cfb06d655affb945cf07e9dce6
  • MD5 ef73e58caef4843d3d1f525c37d9f1ab
  • SHA1 85bf64644634125edb40b799ba5f84ef2afdc187
  • SHA512 3ea11d7d4c785a4ed8db1834d525d5c529c382922edb51af0ff152cd31eca0c75efe2881c3a2270afc1e8776af82a37aea29b254fccf253c40055393e511fad6
  • SSDEEP 6144:/lnhrwtlI+CRSeyCGEgDITJNQtsC3nBot3VmS/So3czJWF7YtTztLAooKE:/lnUCx/sDcrsssilmS33czJWF7SZwKE
  • TLSH
    T1427412635340D873D49A477026392DB31FEDF92426A9AB0F5B10A6ECBE17210DC1E7A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Loads dropped DLL

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/NSISdl.dll
  • Size 15KB
  • SHA256 32e35e4b97f8df08f07d8879ba2ec963c75707440cfc0275e944a31c946f633f
  • MD5 58696f9e1a48139fb1b0ed289a88f386
  • SHA1 71ed08169cf00dd00d41d41395fd982ff8e8c5fd
  • SHA512 3feac3983c39194d9101c803d69c395c33d8757e6ab746447f0f22ee9d0d8f790bb4f0c6c9f4fe7fae66cd6119c2b456c02ab051ffb62af4d010387998760d33
  • SSDEEP 384:3rSQMCOUILnCaSPy/yhJzmGSMRWyOUKiR:3rSQMCOp0yamMRWysiR
  • TLSH
    T15C623C16B62084F5CBB2167034D73B3E6BB28F6A1A2848C24BF35C4E9E52307B675D85
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
  • MD5 6d08f0d5503bb100b8429fefaad163a6
  • SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
  • SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
  • SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
  • TLSH
    T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
  • MD5 cf0351a2ab9128838be6b54cea8238d3
  • SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
  • SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
  • SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
  • TLSH
    T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 7KB
  • SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
  • MD5 c953dd0aab774f1446fcd63fa7c5f613
  • SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
  • SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
  • SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
  • TLSH
    T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9