bcbfe7125322c10596f3dfada4fb78e87d136d6bf375154a8e7381e5613ac37b

General

Target
397skx3p61y3rdzy.exe
Size 514KB
Sample260716-rhp45sfs2m
SHA256 bcbfe7125322c10596f3dfada4fb78e87d136d6bf375154a8e7381e5613ac37b
MD5 80f0639b8a1c049bb9561873652031c0
SHA1 541c853c3c6e72f6e45eb7feccc1ac7500924d5b
SHA512 0e4877c0e1fe51f6de521bb19a1a0f40ec758dd9b49da0adc5130321090b07840534b7275ecdd84317e8c106cb0f3a18945319ed2b3eaa3eb52b9fa6d7d03ace
SSDEEP 6144:aD7gOGkx3hSwcdHnoaL70qa/Pm732Td8iKpy5SdBCFmZw5FEFUh9bQQzQZlW0n02:YlGkx3EZdHok7N2m732TuiKgaKuAQ
TLSH
T128B429143FA98A08E581293E458E1615DBAED1F126326303370AEF625D05DDEDE3D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  397skx3p61y3rdzy.exe
- Size 514KB
- SHA256 bcbfe7125322c10596f3dfada4fb78e87d136d6bf375154a8e7381e5613ac37b
- MD5 80f0639b8a1c049bb9561873652031c0
- SHA1 541c853c3c6e72f6e45eb7feccc1ac7500924d5b
- SHA512 0e4877c0e1fe51f6de521bb19a1a0f40ec758dd9b49da0adc5130321090b07840534b7275ecdd84317e8c106cb0f3a18945319ed2b3eaa3eb52b9fa6d7d03ace
- SSDEEP 6144:aD7gOGkx3hSwcdHnoaL70qa/Pm732Td8iKpy5SdBCFmZw5FEFUh9bQQzQZlW0n02:YlGkx3EZdHok7N2m732TuiKgaKuAQ
- TLSH
  T128B429143FA98A08E581293E458E1615DBAED1F126326303370AEF625D05DDEDE3D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection defense_evasion discovery evasion execution persistence privilege_escalation ransomware spyware stealer
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1