ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c

General

Target
ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c.exe
Size 16.2MB
Sample260803-bp56yaac82
SHA256 ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c
MD5 ac14f6dacdf01b8257412a33709a2891
SHA1 acbead7f0fbc8b7b392f2edb91c1a7ed6f9d96e2
SHA512 5ebf75681b9df15d9f286c884ede04a1b06a960c333ff65ce28a99ab3e16b999eff60a5295de1a09b1ddaf62675cbbced5bcea55f74ad03427fd3839e1687c72
SSDEEP 393216:2MkEDpSeSLpw9LI5VUHbHfsJwB8RAYhUl+LgeL7xrgz:2pEcvpa4VUHwuBonge3xrgz
TLSH
T15E0733BC90D04791DACDADF3ABD997077C354523546EAFCA05826C28860F7B2B2F612D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c.exe
- Size 16.2MB
- SHA256 ebe31ad40a9ce206268d9f355e42ca4979847bfd861b3d157c06ed1bd842219c
- MD5 ac14f6dacdf01b8257412a33709a2891
- SHA1 acbead7f0fbc8b7b392f2edb91c1a7ed6f9d96e2
- SHA512 5ebf75681b9df15d9f286c884ede04a1b06a960c333ff65ce28a99ab3e16b999eff60a5295de1a09b1ddaf62675cbbced5bcea55f74ad03427fd3839e1687c72
- SSDEEP 393216:2MkEDpSeSLpw9LI5VUHbHfsJwB8RAYhUl+LgeL7xrgz:2pEcvpa4VUHwuBonge3xrgz
- TLSH
  T15E0733BC90D04791DACDADF3ABD997077C354523546EAFCA05826C28860F7B2B2F612D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/$R6
- Size 1.6MB
- SHA256 56839bdde72da649b8a583d5c1a6b2bd4e9e28b78b95d149c8be2fa282f9ca74
- MD5 b8bddcc16e2aad890ea0860027c5f1fc
- SHA1 d952ae6be3e37f413b75e8cbe1252330f7fb507d
- SHA512 8bfff14fe00af06c3411cae47656ed6ff1bd5ad8a9a912efec29e6435465ff02d8563f61046b28f2930323ee83fe0b2d69aa71d7a213856f3e6106bbd63d8143
- SSDEEP 49152:0Lqcmyiax47y+Ae2y3YKLWBYD4FcYP/GUdXWox:0LqcmyiaO2LStSc0N/
- TLSH
  T1D77533B5C2D029877FCE6D037AD54B1E846B1A66CF1DF20BD6627421E2313A5F2950CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78
- MD5 375e8a08471dc6f85f3828488b1147b3
- SHA1 1941484ac710fc301a7d31d6f1345e32a21546af
- SHA512 5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8
- SSDEEP 192:MPtkumJX7zB22kGwfy0mtVgkCPOs91un:9702k5qpds9Qn
- TLSH
  T165325D15135046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF386C79D79352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 482536968672d70279a5204060ff84ace25237f24b1bdf3b02e289d50ea5450c
- MD5 4bbc9d77ef7f748f8c85750c3a445f0a
- SHA1 d57a8304bb44ccdb3163b880b3c1bb213461399d
- SHA512 b9430939daab0c8b7e77b96f2f7f85e8e1abd9f43eccbdf94078f77ef05b31a2a31f04ca3a2eff5aa7cc965029ed437af2eb100c197ef51f128ca827ad20e902
- SSDEEP 96:z7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN63e:fXhHR0aTQN4gRHdMqJVgNp
- TLSH
  T177D1FA7675E22EB3C54ACE353C52772B57F8C8111B9401549B978BD238C5EB3EA29282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4