1c3f3b51155aa5678b578869001ceff9d8694b8ed1ef68c325543d1b03be4ade

General

Target
r3ktvirus-master.zip
Size 524KB
Sample260721-stecfsbf82
SHA256 1c3f3b51155aa5678b578869001ceff9d8694b8ed1ef68c325543d1b03be4ade
MD5 b3ed4db7682b577a8967cc5fe68a5acf
SHA1 5c2dc57de1a8cee568dd8a3df8f838085c313b6a
SHA512 e4ceaf1ec7ce12f13e0eb28288cc0dd0187d5605eadf76a94dd8c690e53de1e14c4e178a1b8a3920e4084c1d32ccfae788b895426931ca9fc866fe67cc441055
SSDEEP 12288:JRRYAXw7vW78KwVAPNQeTLWoFgck+iDEqPCgFveNBev0JNAXIrnQUu:5YAXIO78NSPgR+5gFncJPrnnu
TLSH
T1E0B4238841F096B6F48E7E93DF5DCD629A9210A12A30136C527A0D1EFFC6B1D9FE144E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Black-mirror-main/Black_mirror.exe
- Size 996KB
- SHA256 77279d21ddf9f6d52e1d5560926eb860682fadfd692931be5e8fc8ddc4842106
- MD5 4e31a7a9a2d15b4d4c77ac5e8e9400b7
- SHA1 4cb0beabc6060676ad2824936800dc324939f6f8
- SHA512 0ab720876acba25ecf73115e39015d561b16c500e8b93513d6a774fa14cd978cef6000c3e16b9f4f6583cde0468e5099908b75c8d95df1a588c5dc90eb92d99b
- SSDEEP 12288:FJG+f1v/BifmccXlcCNmerADPSjzbJn1SFLA3m0aK:GmBieccYUio1SFLA3m0aK
- TLSH
  T11D259445F6865E9BCC522378049AF3313374BED463225B638AB8F937B813BC46DA61C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware bootkit defense_evasion discovery execution impact persistence pyinstaller ransomware spyware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2