5572acf0eb29b2768c6b81b7c65a8bab30e20faafc41c4c79c7394d138bca4d5

General

Target
Loader.zip
Size 23.2MB
Sample260728-rnjvbayare
SHA256 5572acf0eb29b2768c6b81b7c65a8bab30e20faafc41c4c79c7394d138bca4d5
MD5 c5e6dc16952cb6a0ca23cf20bedfa070
SHA1 2a1edbfcc5777872636b7a024f4154df3cb05892
SHA512 532cadb8be5c5d32841e3654d4d0232d2ad77dc551391ed10554d78029ba626aa54d0314b8a6eabc13e5bdff08477e2a15d6bf8370d233726747bd870b184c24
SSDEEP 393216:hMk4spM27onGeTMaiR9+MHewsA0vpyj4TRyf0OgUy75RvCAi9zgHhdsWfO4Y73nK:hMkZM27WGARzMHewsA0oj4VSoNRqAi9c
TLSH
T1493733BF0426DBCF649A226AD3854C6C58FF68531494D87821D67E0ED3C87F98389F86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Loader/Loader.dll
- Size 24.4MB
- SHA256 bfac4b8cdc138db0bbfd7ba43eee3d1d34510c9647451f91455c5f1661667cf3
- MD5 50464ad329194305d2bcecfeb041e234
- SHA1 f4a20c14dfc69105b45fc8c960d2a6d691f35d18
- SHA512 9eaab0a82f817703ff5fe9476467528408fbe00c6318f730e53f0572559b687000e22748cdc4a4fa1a9fdaa02558f0e4c817d03cfe8ab6c6d927ef23aadf16e9
- SSDEEP 786432:gGJAsjgBAl3+o7nHDZsyZmdlcOHZVS63d+MT/E3oAZ7uQEPGTKULn9WY:gIbqIu4nHu+mdJFt+MIBuQEeLn9WY
- TLSH
  T1FA47334AB68C44ACD657C179868749549A36388E1B20FFEF43E44B523F639F02F7A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Loader/Loader.exe
- Size 158KB
- SHA256 f20f44bb92ec34f70e05a3814acdc1d5c1ed0229c5ffe6c127a2c199f51b5b55
- MD5 5913c6b0a025fed9353a0f9e381cbf19
- SHA1 59fc4ad5f7ef1480d12e38ca8f4d95c85e77277b
- SHA512 80d694115cad2789929b0e9ebb3b6e19f387eed1c40c3d582ddb133318bc872adff31f49f35793b6dae90a73a2153f0a633929814f7fa28d3b75b81e486ce081
- SSDEEP 3072:xlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT5qJ:PAIwxrI14Q3kYBTM5
- TLSH
  T1E9F33C13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EB60F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral3 behavioral4