6a8cc543d57e602390630c1442d158407a8eebd5e3283a6b35cc722b09647566

General

Target
6a8cc543d57e602390630c1442d158407a8eebd5e3283a6b35cc722b09647566
Size 4.9MB
Sample260731-ferysathkh
SHA256 6a8cc543d57e602390630c1442d158407a8eebd5e3283a6b35cc722b09647566
MD5 b9ea1af83a0c0cd458c9d7191b44780f
SHA1 afd83e034e9e967a6072cf2a9293a6d4c06c0142
SHA512 0de4bba05a1bbf95e14514776c5e2814a68d84b9f2f82a9c7a8c9b46ca0ec2e1beb9b54f504e499f3a319b7cde7670c650fa0834f351c61129c7f50eebc81824
SSDEEP 98304:4FsOUW3UzQFdH1yMQyJTZEHJQkXP4QeMb6iHa5yY0WnNzIj8188rZzx2:4Fs5rzeBkMpFEpnb6tyY0WNzIj8188tM
TLSH
T11A36338698662CD2CE27596D7C52FA1F3C0FDE4598B014BA623175D37896BF1E02B2C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal006.msi
- Size 5.1MB
- SHA256 b25ab2a0eaa16804cb364d32a827148a10d423d0c125deac2f71687f1b9b430f
- MD5 b7b4ee0ae2aab1c5714ed5d0051112e2
- SHA1 7b587459ea9c5b4dcf928572fd1319f28d438f86
- SHA512 d03c80dc9b27e635f2aedb8f13d2ca8fcd196de391908fcb81de66d78a1aebca13949085195fe14acb38146850b885be96cf33dc46701a9aa1fddbad60637973
- SSDEEP 98304:rgfcAQ/XHzG68of3LsfbKk7l49FRy5lgX9/nMM6VREBwlU2rZdt0:rg9Qf66f7sTIFRy5lgPMMgREBwlU2tde
- TLSH
  T10E3623C9BCC93671D147C7B56152B23E392D7FC2BE624C1B36687B441EB2636A036386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2