1ee41388c7497d24281f870418a39d836f10011d41bdcd73dadaca34ae093524

General

Target
CODER-HANDOFF-9ae9499 (2).md
Size 17KB
Sample260805-j6t41asfqa
SHA256 1ee41388c7497d24281f870418a39d836f10011d41bdcd73dadaca34ae093524
MD5 049b4416ac55b91a76d6f1ef8d5d869f
SHA1 3d097861ba4dec3dd47a821162b4f574506cbb9e
SHA512 5f8915b0abf597d2b1dfdaa9460ef5ed51d99fdb8914e39986ba2bf82a9afc1767550aaed9b734da4f80f2b2b445caedc6bec15b274116f1fc18814aeea62b1d
SSDEEP 384:uUsVXZrrcVjY7Mj12NqjIQAR41Qht1/SQJs9siqzN2ywe9FYFjLZAlJYggaAes/m:bYrBjDaH9+SyZAese
TLSH
T14E72F7A29B3832F90F63905BF60673979F62A1F527431312F0CF856D129E056C37BA82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  CODER-HANDOFF-9ae9499 (2).md
- Size 17KB
- SHA256 1ee41388c7497d24281f870418a39d836f10011d41bdcd73dadaca34ae093524
- MD5 049b4416ac55b91a76d6f1ef8d5d869f
- SHA1 3d097861ba4dec3dd47a821162b4f574506cbb9e
- SHA512 5f8915b0abf597d2b1dfdaa9460ef5ed51d99fdb8914e39986ba2bf82a9afc1767550aaed9b734da4f80f2b2b445caedc6bec15b274116f1fc18814aeea62b1d
- SSDEEP 384:uUsVXZrrcVjY7Mj12NqjIQAR41Qht1/SQJs9siqzN2ywe9FYFjLZAlJYggaAes/m:bYrBjDaH9+SyZAese
- TLSH
  T14E72F7A29B3832F90F63905BF60673979F62A1F527431312F0CF856D129E056C37BA82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence ransomware spyware stealer trojan
- Renames multiple (6136) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1