0e9fabc83a370f951438a091413916fafda073bcb13723fe5e23773ed00c991f

General

Target
950031040990dcac28adeb03f0c0ebbef3e31c8666a5d6573741489280c18216.zip
Size 933KB
Sample260712-ns2n5sg14l
SHA256 0e9fabc83a370f951438a091413916fafda073bcb13723fe5e23773ed00c991f
MD5 afea3e24105fa94c62b452ad25476a4e
SHA1 2be143857af2541ce6ef9e3a062ec07541c1425d
SHA512 5cdaddffc7939fcd4ce8014e74f1fc0e1553d47c22c2da04c2f1eb760fb516861514934a0c1e0cfbb8ac6163b6ec0c7b685f2ff7cd49e7b964e8799b3d04f7c9
SSDEEP 24576:E2tZwx8Y3+TPcNexBptYmsauTfgDcQqXbPu:3wx8XwuttsauTfgwQqXDu
TLSH
T19D152372159E32AD5B28A827F27951FD462B09DFF28D85FA0B3FF4A112ED8171041A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  950031040990dcac28adeb03f0c0ebbef3e31c8666a5d6573741489280c18216.exe
- Size 2.4MB
- SHA256 950031040990dcac28adeb03f0c0ebbef3e31c8666a5d6573741489280c18216
- MD5 acd02a4f8b25e9106400e0a3af63a760
- SHA1 12398d1d506a8800804b4b1919694e68085d7c84
- SHA512 a0b11cad198ea2c3b28e7083fe6485e8a8ed1610d81a96159ff24be4fe4ddb20db772a1c46a80561f191b2c59314ab5d6ce38df6e4e6d792b33eb0e2dab066e7
- SSDEEP 49152:+AfqBgF6yzhmyYrb/T+vO90d7HjmAFd4A64nsfJqIi+fmB5EeH5gCDH0qOMNmPD1:d5Xz4yREe
- TLSH
  T1FBC54A4BBC9044A9C4AAE23089665152BB717C980F3233C73B58B7F92F72BD85E79354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (210) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables service(s)
  defense_evasion execution
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Disables regular backups
  Uses wbadmin.exe to disable Windows backups.
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2