331057d48668e381c776c47ee74c77d64c0ced3fa3d899dbab3d51f805693107

General

Target
cookies.txt
Size 4KB
Sample260720-a9ap4aax2k
SHA256 331057d48668e381c776c47ee74c77d64c0ced3fa3d899dbab3d51f805693107
MD5 503035e2da6f9b94543195adade061cb
SHA1 1a31fb885335e4211b207af724f58cd2930980e0
SHA512 85fc19b5d737bf777299bc5a0b5b9f2376f1985906e4a32937502f4b8a1d58a93e1992d8143ff50a72b6327f18f001a1cf795be286c42e3e32d64a2cd12c45ea
SSDEEP 96:cpYZAGLLl1NANYZAGLLlZTB7TYZAGLLlU1YZAGLLlKMEMYZAGLLlI:JZz9ZzR4ZzxZz0Zzy
TLSH
T164A1641811241CBE9E87126A7D092ECDAC3C0A535548DEF9FCA9CD5CC5A1B6242F98CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  cookies.txt
- Size 4KB
- SHA256 331057d48668e381c776c47ee74c77d64c0ced3fa3d899dbab3d51f805693107
- MD5 503035e2da6f9b94543195adade061cb
- SHA1 1a31fb885335e4211b207af724f58cd2930980e0
- SHA512 85fc19b5d737bf777299bc5a0b5b9f2376f1985906e4a32937502f4b8a1d58a93e1992d8143ff50a72b6327f18f001a1cf795be286c42e3e32d64a2cd12c45ea
- SSDEEP 96:cpYZAGLLl1NANYZAGLLlZTB7TYZAGLLlU1YZAGLLlKMEMYZAGLLlI:JZz9ZzR4ZzxZz0Zzy
- TLSH
  T164A1641811241CBE9E87126A7D092ECDAC3C0A535548DEF9FCA9CD5CC5A1B6242F98CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence ransomware spyware stealer trojan
- Renames multiple (6167) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Drops file in System32 directory
behavioral1