fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90

General

Target
FadeSEC.exe
Size 712KB
Sample260808-jyz1aawxes
SHA256 fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90
MD5 eeb8bfc8b1dfa69420cecc94180fee0f
SHA1 0c632def011cc73c3cca7a885c0879ad33191d62
SHA512 ecfdd2bda9116254094c3d39e150d636d05f3a671bd6dc00ecabeabc7fa5285db64b09b0b0415f2eed7631fa3698a549b1d2d138e13a88faf9bca3e1d4fc5e05
SSDEEP 6144:anaYto8mXwGD1KkwqGhK682wfsHfVLHVVJsopR1AMhC/C9fHphafSEqBIiCrDM0n:al/i4XqGgkH5HZzpAwzxFBIiL6D
TLSH
T1A2F44A2AAAA004FCD17AC27BC9570576FAB2780707A19ACF078045175F2B6CD5F3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FadeSEC.exe
- Size 712KB
- SHA256 fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90
- MD5 eeb8bfc8b1dfa69420cecc94180fee0f
- SHA1 0c632def011cc73c3cca7a885c0879ad33191d62
- SHA512 ecfdd2bda9116254094c3d39e150d636d05f3a671bd6dc00ecabeabc7fa5285db64b09b0b0415f2eed7631fa3698a549b1d2d138e13a88faf9bca3e1d4fc5e05
- SSDEEP 6144:anaYto8mXwGD1KkwqGhK682wfsHfVLHVVJsopR1AMhC/C9fHphafSEqBIiCrDM0n:al/i4XqGgkH5HZzpAwzxFBIiL6D
- TLSH
  T1A2F44A2AAAA004FCD17AC27BC9570576FAB2780707A19ACF078045175F2B6CD5F3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Renames multiple (8463) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1