Extracted

• • Target
    Delta.289.123,23.exe
  • Size 594KB
  • SHA256 6bedbe1c3e8eceb69531c82728290394fabf5475a0a830e807a89ccbcc92bd18
  • MD5 3317da6ae819a40cb8d980f29e9e7766
  • SHA1 a4ac78e04f75a1801ae4a2abd5fb342543571aa0
  • SHA512 d799d3a9676ad2c864942d4238845b1cb445c7171c7c5047e275f6c9fa8db2b91a851e7f7fb8e5095bebc310bb946bff69544e63d1769e201c0651afe00b6d23
  • SSDEEP 12288:QQQR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIBIk:SL4kkA7lXkXDDuAOFhWSApia
  • TLSH
    T170D40204B7FC3615E7BE8B3E59B090440F76B2534A20D21C5D83D4AA1675F82EA64FA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasionexecutionratonratpackerpersistencestealeradwareransomwarespyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2
• • Target
    costura.dll
  • Size 5KB
  • SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
  • MD5 109bd38d2107f41573c48544992ead99
  • SHA1 028e9832f421f11f9497c610f1734e0f3d868037
  • SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
  • SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
  • TLSH
    T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    costura.pdb
  • Size 7KB
  • SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
  • MD5 dd3394a0ba6f7158d029e1c3a31b7a85
  • SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
  • SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
  • SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
  • TLSH
    T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral5behavioral6
• • Target
    stuff.dll
  • Size 12KB
  • SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
  • MD5 f8d5274e3368aa40cc0fd5798d19c783
  • SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
  • SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
  • SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
  • TLSH
    T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    stuff.pdb
  • Size 49KB
  • SHA256 5a3d0e35dd6e13324b0edff9039c9f56bebe485bfcb111a3d4a75e66c0f561c3
  • MD5 2747cbc9ab74e2f10603ca8414632128
  • SHA1 8c8fa0185a2cb3bb863e5db51b6bd354a2920b8e
  • SHA512 bf4c1f5abc3720357cd472fb1538e3d9c07a2cda9a365d290257be79ddf040128df6325e6d8cb0d91c85862d5c4e9c4dce3cf557fc9de5865364646c5fcabea9
  • SSDEEP 768:q83r3aOQJWT2NpMTr45hGYjUwYsqh5qOQJWT2Bpv:kpMT6Gpwuh5+p
  • TLSH
    T1A2334E07B780DEB3D456463831A78F5C4778EC10AB86E34F23AABA3C7EB1B590D51598
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  persistence

  • Drops desktop.ini file(s)

  behavioral10behavioral9
• • Target
    system.buffers.dll
  • Size 20KB
  • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
  • MD5 ecdfe8ede869d2ccc6bf99981ea96400
  • SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
  • SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
  • SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
  • TLSH
    T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  adwarepersistencespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    system.dll
  • Size 1.4MB
  • SHA256 541c6067cc69a43660d06a4f0f6eab0febcd33df9089f209d99b7ea36682a0a5
  • MD5 1deea6add28d3eb07c75908d57408c72
  • SHA1 f363829dc6bead421d88962c3944e8c041d5c5fd
  • SHA512 6fbb29cfa1b40c034c85c6d8499de887de9a0646de799635812d98259e85bec75c08ceb00b45af84167ee071ac7e3e2fc13d0057c9ebd0a79f0e882614a6b386
  • SSDEEP 12288:dZ3rUBYSL8iKNE6Rb1PwJ/Lnw17e/mY59SVFZWoMLziodEtUygRy8P6/B0OahWMC:blb1P7RY59SVFSi6EtURFUB06R/RSeB
  • TLSH
    T1E565181133E41E6EF5E30736B97945A07A36F9C72702CF4F5060A29E1C67B83AD613A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14