Extracted

Extracted

• • Target
    _336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374.exe
  • Size 8.3MB
  • SHA256 336c35fa5189d4ad981d7d4c284f1cee64ccf0758b685ac682cbf3a91a4ae374
  • MD5 74ab1b73d1f3ca016cca7552e0d46efd
  • SHA1 0e234eb13a5b1e51e2ddc2b06fa417ed20683fdf
  • SHA512 b989077a779d682a2c3a472c7fec68fe66c4f732c424956d2f524292c98acad31d384bca3420ead9d39fb37aeada597a09d81c83260873282d8afb7e753bfa97
  • SSDEEP 196608:qyZ5PYXMCHGLLc54i1wN+wV0cSXl74w40wqfP8gT8XlOnAJ:qyZ5gXMCHWUjYVg74w9rfoJ
  • TLSH
    T1E796335CA9A016F3E9F3917ECAA1D90AE6367C691F72CCC713F442162F232D55835362
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationstealeradwareransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2