5b1f71a48a1cd34704ab652003260102683b588ba43eba21cc650e7806678381

General

Target
5b1f71a48a1cd34704ab652003260102683b588ba43eba21cc650e7806678381
Size 9.2MB
Sample260803-tzljdsvyax
SHA256 5b1f71a48a1cd34704ab652003260102683b588ba43eba21cc650e7806678381
MD5 aab7dff2ebf7c48468c4765fa3f36f47
SHA1 e5f051100215e5d3afd2fd07ee792beb61d7d0dc
SHA512 6f36fe2fb1d3e9acd6e0383e4fbdd1cef32f0d3ad6e23c8edf9bdc7cdce801ba1f775b6c529079952e6003877af2a44d89e3973356d69a96daeed4279c66d951
SSDEEP 196608:f0Q7cyoZ/fpfCvGWh40szgfVI483gzKmlGVZXXMAsBGmVh:fdro/u7G0szmID3gz1MzuBGm7
TLSH
T17CA633CE5EB8C65423A2952719243A03CBC7B9408F85EFA979D685B0FDB397254E0F43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j018.msi
- Size 9.4MB
- SHA256 8ca85d059b589bc3040f2cd935392537c757fb3ca5a323594ac1ffa83a8930aa
- MD5 cf17e21a516a7d2c2ff02650f56a0009
- SHA1 84fa5d2683236a64bba9f6d2bab76cc2044a3e8e
- SHA512 398e097585c6530cbb64c9d6863524ad11435e201abb1ccb6c456b5328ea138ffe92d15f0335fa1daa1fe4874e4b77e0f8cda986e22f0e9ebde4c162c6b9629d
- SSDEEP 196608:ltVdLWLQkuSg/GXJCqedovKQTCxLPZlXGCsrGkhp:lNUJdVCrdovDWVrorGkv
- TLSH
  T167A633CE6DD49370C193C77101513A6E7E5A7FC1BFA2AD0B3AD93A10AE7263255B1B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2