3ac798246951d6331bf6f0a9ff265fe835421e09269d7eb49015c551d02db0c6

General

Target
dpiOptimizer.exe
Size 34.6MB
Sample260803-e8y4hsydke
SHA256 3ac798246951d6331bf6f0a9ff265fe835421e09269d7eb49015c551d02db0c6
MD5 af5978bcd37381607285e7a37a3c2497
SHA1 fb55945bb3c27c38644d377675399e624be9eef4
SHA512 8ec1a84a35e1ee0d8f9dcbdcb1602000842d7cb8b62c6c754715a9caafaa37cbf9e5d285c32f018dbc104bad01a54526c6f49e9cb3f50df786a0b1f21aad360b
SSDEEP 786432:ZEmwV8p+uMLAv7odk1f4nbxFDmWKU09fjJL9WJRtYXwqfYvV/M8+wkDrO:8V8p+uMUv7/kFyWC9rJpWJwg8N8+tq
TLSH
T142873340B689539DFDA2F43DAA926C71929334B1AB73C5432295E2D13DB32D13F3B219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  dpiOptimizer.exe
- Size 34.6MB
- SHA256 3ac798246951d6331bf6f0a9ff265fe835421e09269d7eb49015c551d02db0c6
- MD5 af5978bcd37381607285e7a37a3c2497
- SHA1 fb55945bb3c27c38644d377675399e624be9eef4
- SHA512 8ec1a84a35e1ee0d8f9dcbdcb1602000842d7cb8b62c6c754715a9caafaa37cbf9e5d285c32f018dbc104bad01a54526c6f49e9cb3f50df786a0b1f21aad360b
- SSDEEP 786432:ZEmwV8p+uMLAv7odk1f4nbxFDmWKU09fjJL9WJRtYXwqfYvV/M8+wkDrO:8V8p+uMUv7/kFyWC9rJpWJwg8N8+tq
- TLSH
  T142873340B689539DFDA2F43DAA926C71929334B1AB73C5432295E2D13DB32D13F3B219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1
- Target
  dpiOptimizer.pyc
- Size 52KB
- SHA256 3fa78da71f4b02509c358a8ca1fcb1991105b9a6a3a6ebcb3c34c94c1cbf4a2f
- MD5 30df441e7f156d3b01a3a4eef64256a6
- SHA1 54bce4353f8db4bf9309c6021569f24680f8432d
- SHA512 ed6a0facdad53ef9f0a65bc7acb374d20bfb212de1370764663b92739e32b16dc3d79c37901edd33ace633ab5a5f8297371f53279144317c4d72f644eac28d08
- SSDEEP 768:iPDNaYBqCfLYA2syvcOiVCECNLxV+qrbWh5a+UFDutFiFsKw5to2otCvSbmRO:VCfLYGyUqWh5aPOY5eto2otoS/
- TLSH
  T1F1330747E4618005EF51B5B694D91804F39DABF2F631C366311E2239BFE72B5CEA930A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2