2e1cd6ed59c790965ea60b124397703258f50fa6c4dd6c605179f92849ce5306

General

Target
6ea3d8d0.img
Size 90KB
Sample260806-js1pmage94
SHA256 2e1cd6ed59c790965ea60b124397703258f50fa6c4dd6c605179f92849ce5306
MD5 95761d1df0e3a6e5f29248905796a524
SHA1 99513de767a99e2150514ff6227849a5da82f965
SHA512 b2af349b0ba3cb8b9804e70f8f0bb63c446de80e6f761ce42b6d3451e7d7d98ed17f2487c4910378453f54abd69ea227a39b7dde1d698d421b8d7cb438adc108
SSDEEP 768:bmtCefiOCCBIG0YByuZI5WqeZEpKkXrxPbrnFYCFc:ybN0YjZI5WpZcxPHF3Fc
TLSH
T14B931C38CE71ADC4C36B31F2455A3E35508A02A396B44A78BC8DB8B55F12749EF3E359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  6ea3d8d0.img
- Size 90KB
- SHA256 2e1cd6ed59c790965ea60b124397703258f50fa6c4dd6c605179f92849ce5306
- MD5 95761d1df0e3a6e5f29248905796a524
- SHA1 99513de767a99e2150514ff6227849a5da82f965
- SHA512 b2af349b0ba3cb8b9804e70f8f0bb63c446de80e6f761ce42b6d3451e7d7d98ed17f2487c4910378453f54abd69ea227a39b7dde1d698d421b8d7cb438adc108
- SSDEEP 768:bmtCefiOCCBIG0YByuZI5WqeZEpKkXrxPbrnFYCFc:ybN0YjZI5WpZcxPHF3Fc
- TLSH
  T14B931C38CE71ADC4C36B31F2455A3E35508A02A396B44A78BC8DB8B55F12749EF3E359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware trojan ransomware
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Click to open the file.vbs
- Size 29KB
- SHA256 29453368a7c14218e8cdbacd177c6b82e30a8642e9aa5bfec4b48067219d9214
- MD5 493459e39273df7b71f22e12df90a748
- SHA1 414399e19db2daea22d2347e95aa3d3323091c3c
- SHA512 f500465e43e035fe559a0325e6c5511338ad1fe57a70a62ffb2591f5e94c4a25b41da696d223e8f7c14c62b354cc0ce7a30715051cc8932563e4bdae9d4069c8
- SSDEEP 768:DtCefiOCCBIG0YByuZI5WqeZEpKkXrxPbrnFYCFc5:DbN0YjZI5WpZcxPHF3Fc5
- TLSH
  T168D24F38CD71BDC4036F31E25A9E3E36508806A397A44A78ED89B8B55C20B49FF3E55D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware trojan ransomware
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4