472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873

General

Target
dogshit.zip
Size 13.7MB
Sample260801-bvek6scl71
SHA256 472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873
MD5 60590ec8bc5f99f5c6cc3cf2800bdb59
SHA1 7291cc4e9237074b39a9fef54e0963866c67c326
SHA512 1d7d2193d56d984f7a62e09041427f7d25cc5234fd7395f4b8d9eb8664600631c346e7699be3a451cfbad0a42e8a86e211a2f60199267dc80c1f651e4262b3bc
SSDEEP 196608:t2A+wW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7Y4mIEvnk0H:tjgCDQaC28nl78Kg6zCWCdFCIEvnk0H
TLSH
T116E633811935C0CAE5750733D998CB9CEEE19D318785CE8DCE4C6C993EAAA2B274F744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dogshit.zip
- Size 13.7MB
- SHA256 472ee5813c5fbbe7e1c3fa9cc14b47bd2c2c3b800d31de24537ff68a61335873
- MD5 60590ec8bc5f99f5c6cc3cf2800bdb59
- SHA1 7291cc4e9237074b39a9fef54e0963866c67c326
- SHA512 1d7d2193d56d984f7a62e09041427f7d25cc5234fd7395f4b8d9eb8664600631c346e7699be3a451cfbad0a42e8a86e211a2f60199267dc80c1f651e4262b3bc
- SSDEEP 196608:t2A+wW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7Y4mIEvnk0H:tjgCDQaC28nl78Kg6zCWCdFCIEvnk0H
- TLSH
  T116E633811935C0CAE5750733D998CB9CEEE19D318785CE8DCE4C6C993EAAA2B274F744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence pyinstaller ransomware spyware stealer trojan
- Renames multiple (6578) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1