0bc8ec70e8efd736da9156b607631079764c4e141ca6724fe97d805305cdb97e

General

Target
0bc8ec70e8efd736da9156b607631079764c4e141ca6724fe97d805305cdb97e
Size 5.4MB
Sample260731-nfbbeser2v
SHA256 0bc8ec70e8efd736da9156b607631079764c4e141ca6724fe97d805305cdb97e
MD5 7a4860c98243d2a2034ab2cdaba1f22c
SHA1 81e13aca88d9a037a576692fadb245b57e8a1b18
SHA512 2afab07abbe77fe04d47cd053a9b1dd422957a9e6d2e8891ae54faa377783fe8ccc72c6565ffe1db32d3f81ca1458f9d631c689ced0b487e9c7f57ded58bdf81
SSDEEP 98304:3ZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1c:QyBOALr5ZXSDAmZ+0c
TLSH
T1DE46331AA9D7FD26DC43FD6471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 a096ade5300da53bce79618c5be69e9d85b92f35095f2235f822c00ed61bd680
- MD5 68218b5a5c1a16f3fb89a50764d29758
- SHA1 dd720386b83120cdd695d4072206b843c6a42a6b
- SHA512 eff798c37a05bfaeb8d2d47a6e50832296b63c1e75d510e2a687288263bd15f68114ddee31bb7d0b09054007a9c5b28db4cac649719557d6a415699d991f4f5a
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8fY:z8H6F1MJhTZ3Qe8i2XkghA4V6YY
- TLSH
  T14A5633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2