27f0f6463aaa29a19da97cc120f19443493510867da905aeaed1bdde5d94f2ee

General

Target
v1.8.0 (3).zip
Size 135KB
Sample260713-m2fmlahz5w
SHA256 27f0f6463aaa29a19da97cc120f19443493510867da905aeaed1bdde5d94f2ee
MD5 086ac54a69767a02b488ddaaf886c7cc
SHA1 5e4da5281ad2754bf33752cd873e5e167b176d11
SHA512 999f1fb09216dc09c1e058936ff391ba672c401ec25842b86119e1ac967463757a41a0e241820a923b7c5d7acf3a237195d97cade3d7b4c7473718e2f42d1586
SSDEEP 3072:JfAFlbol3uzYA7nFAp9WwjaBtK7hjVvpT1pgpeLgJpLrtU:WzEl3uzYqnFKXQY7LpBepXpntU
TLSH
T179D31207E4F14894D04CD6F3AD9BF56EDE7DE440BB8294A538841EEA53EA0021F38E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  v1.8.0/Exitlag.dll
- Size 29KB
- SHA256 621bff60b096f55b4b56637b68f3a53de3bfa7742fe91c75e35e41e8bf3dd2e1
- MD5 21a9e955c8fd011a9c01f6b0e36804af
- SHA1 749aa1506d1486a2528c25ccf88b7a06f34a31f0
- SHA512 a87b10ab4e304de35c43889c6acb93f0c555caaa28cce57b59d051cc44df9872f74db4ffac2c9550a928dbfa1874c8c6353e4d588ef73dc4279ebc29396b5f09
- SSDEEP 384:uKsHjWSBICb/sRKmLfktQBwvQA/Tgmo6UKfbXW8Zh/MMm3MZNjTr:VsjoLLfjwvRbzo6fJsb3MDP
- TLSH
  T10DD24A4AB36545D5E26BC238C5131A1AD173B5646731938F07B312A92FA73C07E3EB4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  v1.8.0/auto_signup_updated.py
- Size 10KB
- SHA256 ab43d25119556159d5d372fb181418913bd21903203de4516bd76ac42f459da4
- MD5 46342d907f2554390332f39ec9cf0ead
- SHA1 fa8b85d231fb4afadd453b9be9105649d6d236c8
- SHA512 e272944651f4b230aeb4947c86297d40aa5441fca2283b936c7498eaa34910af89389b2868e1e5e65309bb20c7aff9bd17e4043c64e8d2da7e2080a2e81c2a5b
- SSDEEP 192:mDTo6csobflFbtUXagQfTShaQYEcgt6ivqLLF/xej+i:mKtj1TYa8cESLR/xOv
- TLSH
  T19522303268451C90B353CD1C98B64C91292ABD23FB663864B5ACB2D45FFCC36CDA19BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2
- Target
  v1.8.0/exitloader.exe
- Size 573KB
- SHA256 b3eb5fa950f798e33eb40b2740a9a21adb031542372c17a7b4aa381f605ba7cf
- MD5 cfd93685b796b67d7f1237d7801b8f99
- SHA1 3a28ec5b7a529655ddd16bd0844703a25425c17f
- SHA512 6e53465dd37be7892446b370000a6e20b65e94beee6e19a7d94ccde78e1d04eba442c2981ab4c6a49b8156cb06cdf9ac3f4347f4652cf139e518839c966c492b
- SSDEEP 3072:waxtP28UWpC23DNmLSwaVHjEpLUM4WOKHsEM9GvMWbNPZYC1zN6zFq5i:wWjUWpFDNmLSwXpF49KHi6tZN
- TLSH
  T18FC44B29F9489169D0818976CE6388A2E6737F455B3D49E737B1BF7E4E311C0A734E02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

persistence
behavioral3
- Target
  v1.8.0/python_installer.bat
- Size 2KB
- SHA256 7f1c7b7ad7ca50c8fec69bd79ae0ffbd2d9252332f3618f53bffc10a74c3fc19
- MD5 d13ce3ea32275444a8446b0ad4aa1e7f
- SHA1 44e895428d2cea876e297b1e85f5f954ab07fbae
- SHA512 dec03bf184d642b85973e71419983ea4d636500e5bae1fd4d5f1ee0c05aa3be27808bf4fe8a7fe0de3b90935270c5402a66bfc368546f812e5c32307de6899ae
- TLSH
  T159419C0A320440B651F49B5F8ABC5026F79521AB46126DFCF0BF94242F3979276FE9D2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4