General
- Target Immortal Private.exe
- Size 1.6MB
- Sample260722-r15mjsbl2z
- SHA256 b60c2bf08f63c95b41fa1f8d361991a383bf0bf8d776c91b2af290e9aae2f267
Score
9/10
Malware Config
Targets
-
- Target Immortal Private.exe
- Size 1.6MB
- SHA256 b60c2bf08f63c95b41fa1f8d361991a383bf0bf8d776c91b2af290e9aae2f267
Score9/10Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1