a9bfde2ee7a7e74c70bd1eaadfd8630181a07f0cee2486951e17603cd4a1bbf9

General

Target
BonziChaos v1.1.zip
Size 90.2MB
Sample260706-1gefpahs6q
SHA256 a9bfde2ee7a7e74c70bd1eaadfd8630181a07f0cee2486951e17603cd4a1bbf9
MD5 9f14d820b473d37a56f173b203521cae
SHA1 82fccfb97d3dde0cec2229d1801bf4ed306f96fc
SHA512 42bbcd81e3ccba9a9314894189ab4dc7f3eba3c69974d5f003aa7518bc826394221e7d3ec6eda8a1c8def099be70e74da359edbee3b56af4cff78a31f52f1156
SSDEEP 1572864:Q+d3UuTldTpl21srHzyh86HWiPZANVbZmn1A+8JBjUL/pRq8y2P+5c7HDThn2bPb:Q+dE6lLoirhe4Vz+8JB4By95cbD12oQ/
TLSH
T19028337A5646DBDC0808934D24B607FC89B6792AF8959C0FE3B94D33BB447DE158CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BonziChaos.exe
- Size 90.3MB
- SHA256 59538e868198fe17f8e2326e78a30a20934adb036dc40798a66b711582ece177
- MD5 02fbe280901b65754c0f051f4b59c230
- SHA1 af4bd7c1056bbe90c259caec8a9d22ce1ea83308
- SHA512 9821d96742d479f93f4793c573ecf9b1fc52b6d71dfdc98e6f3114d69ff0849b79337189beea732645adae6544d0f7ad2d043438dc8029405f582b7ec0c403bf
- SSDEEP 1572864:rtYyElBdZLaX7iDs8DO1mCJZzW//9PFDF1kuqvvrHlH3QMquNCFiRBn7PBh9T32x:rtvUBzw+DzCD4FQuqvvVqLFiXnNhMUz4
- TLSH
  T1D32833766682CBF4C80493BC18F753B8C9B93D14FA554C4FA3B409373AA43A6916EF64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit collection defense_evasion discovery exploit installer persistence privilege_escalation ransomware spyware stealer trojan upx
- Windows security bypass
  defense_evasion trojan
- Renames multiple (142) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1