0a785b38260b604467b3c5d11c2637cd17924d0d8b1b764488ca61c97e0a6b09

General

Target
Bj1oU0jZVczhZUb2vq6L1G.jpg
Size 9KB
Sample260805-xe277aek2t
SHA256 0a785b38260b604467b3c5d11c2637cd17924d0d8b1b764488ca61c97e0a6b09
MD5 dd8702fec5ba016b495018d254f5727f
SHA1 a576667dc078ee292095a310170792a1a52a827e
SHA512 93020c4c19ab392b603a969ef437fb1f9307d6debd29e9f4822bc9850b15028253247c5182c5d91e699273dbb3c061fce25c1c5a22eab481a539862079d042d1
SSDEEP 192:HNMGRScLqI7NZ2PBkN3CxRWAn/uuP9iS1zD3ncNRrXu9i:66ScOwOBkNS7uKN5DMH
TLSH
T1A6129F14279F9C0EF19D25323164A31BAC735529EBD4CFEA41641FA6838102B9FCD4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Bj1oU0jZVczhZUb2vq6L1G.jpg
- Size 9KB
- SHA256 0a785b38260b604467b3c5d11c2637cd17924d0d8b1b764488ca61c97e0a6b09
- MD5 dd8702fec5ba016b495018d254f5727f
- SHA1 a576667dc078ee292095a310170792a1a52a827e
- SHA512 93020c4c19ab392b603a969ef437fb1f9307d6debd29e9f4822bc9850b15028253247c5182c5d91e699273dbb3c061fce25c1c5a22eab481a539862079d042d1
- SSDEEP 192:HNMGRScLqI7NZ2PBkN3CxRWAn/uuP9iS1zD3ncNRrXu9i:66ScOwOBkNS7uKN5DMH
- TLSH
  T1A6129F14279F9C0EF19D25323164A31BAC735529EBD4CFEA41641FA6838102B9FCD4F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution installer persistence ransomware spyware stealer trojan
- Renames multiple (6136) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1