8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada

General

Target
8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe
Size 826KB
Sample260801-l626qasdkc
SHA256 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada
MD5 fa0818e29653113c8fbfb4dea361e1e4
SHA1 f60675fddda599a476806cc9142761a30775c243
SHA512 5e3d970d7b612fbe9a4cd479cd10fd588d90899af26e206d6e7d2e66daaf181f65dcb6bbb35f6738c6bc337cb899b438af1fe6e1d580ab7ba617a84e9d7e20f4
SSDEEP 24576:N6MWueoFnMQYFK7ghQigf+Rlf8Cgki/BpC6T4WP:7moFnMQdkx9P1gL/lTpP
TLSH
T19605238239E04877D46B8233A9118E83A876ED1A4477554F36107D9ABFB22D19F0B7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada.exe
- Size 826KB
- SHA256 8fd94a0d9730a5a696e1056495b28ef5ca118f94c92c18f6b757369bd3de5ada
- MD5 fa0818e29653113c8fbfb4dea361e1e4
- SHA1 f60675fddda599a476806cc9142761a30775c243
- SHA512 5e3d970d7b612fbe9a4cd479cd10fd588d90899af26e206d6e7d2e66daaf181f65dcb6bbb35f6738c6bc337cb899b438af1fe6e1d580ab7ba617a84e9d7e20f4
- SSDEEP 24576:N6MWueoFnMQYFK7ghQigf+Rlf8Cgki/BpC6T4WP:7moFnMQdkx9P1gL/lTpP
- TLSH
  T19605238239E04877D46B8233A9118E83A876ED1A4477554F36107D9ABFB22D19F0B7B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
- MD5 c5b9fe538654a5a259cf64c2455c5426
- SHA1 db45505fa041af025de53a0580758f3694b9444a
- SHA512 f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
- SSDEEP 96:xr7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkNL38:xxbGgGPzxeX6D8ZyGgmkN
- TLSH
  T185D1E8B932C10DF3D44D46743F22381717BDD476177542A1CB972AD61EA2AE2FE21B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Pretangible.Kuv
- Size 53KB
- SHA256 314383aea943ca5f5700c4071e830587fcb6a63b6e374b87c1b6f71376e1b55f
- MD5 a44b8d7da3b00d8024e89ce4052e8ef3
- SHA1 3a917dd7e85c772ad1b078ffb1f57deb92851a84
- SHA512 388782448474dfedb2887a964cab4ba5dd2dcd494740243cd4278fd4b10eb284089a054673aedaf30fe756c002dbee998d9a7cb0064434500a50a855330dedbd
- SSDEEP 768:Cmnp5dy0K7CK34zZjtAd3QY4VlMtsQI8Iy+7cYcxsTzkHzNBNw5t3:Cmp5dy0CoBad38xQIOEVY1E3
- TLSH
  T1EC338EFFB59075416AFC454E9E2283DC85936CBD1B6ED4384EA9C58B04B02F64F3A836
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6