26d7c78c133dde15b8a0327e2cfd9e6b90d7fdb2f76316337cee425e2f3453b9

General

Target
26d7c78c133dde15b8a0327e2cfd9e6b90d7fdb2f76316337cee425e2f3453b9
Size 5.4MB
Sample260801-jb41qafe49
SHA256 26d7c78c133dde15b8a0327e2cfd9e6b90d7fdb2f76316337cee425e2f3453b9
MD5 5d4acd03273497ee2b895807a31174bb
SHA1 e0dcf60b8d7ea53f0e69bb65d412c6523244c95f
SHA512 8fbbd2477206032f7032df2f7f3d4aac8fbdd8f2b6262f588e4cbd2a3f78514d3b9145dbf919e6e4195132b76f41b6995f959814354dc71580da97e308dfa332
SSDEEP 98304:eZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1A:vyBOALr5ZXSDAmZ+0A
TLSH
T16046331AA9D7FD26DC43FDA471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 41438dff66c1e9ba3677bfccb82223566460d66300647a01eba459adafd67b56
- MD5 c9b82bfd6d44d194496f951046e4f566
- SHA1 c8da039d7878bafafa77097edc7964814b4e5986
- SHA512 ce2c5e11ca5b48f64da432b6fccc11d2198a3e5176d3a24a82527283ccb457a29f9afd53fbca389911546c68e7de0c34c1ae71739ab52df64665ae3d10812a0b
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8fC:z8H6F1MJhTZ3Qe8i2XkghA4V6YC
- TLSH
  T1835633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2