bdb77e87b9d666634e182ea42482d9559125ca8e62c2399b8ad2c6b42395aaa8

General

Target
EpicInstaller-17.2.0-unrealengine-04b5b611b9934c2aa568d53c4dc14832.msi
Size 194.0MB
Sample260808-yg5xjaxyft
SHA256 bdb77e87b9d666634e182ea42482d9559125ca8e62c2399b8ad2c6b42395aaa8
MD5 392f66528c31a402484379f57d0605a1
SHA1 40d155146d49258d3f3e3d8bacc6c919ad8c1d35
SHA512 24924b00dc61295ff9fd8f003addaa2f56e6774d2b6e20c068d0d538f0c2b1e2af9c6ca117b9718513218734596a93540e8674294ec67ea91f4dec865b473600
SSDEEP 3145728:HyCHcktJLbo4ZW0AF7PPMQxSkn2XbtOk1Ne4rkq//id544fVHBo9LE5XCJuo:Tc81WtsXk2XbcPdij4cJE5XC
TLSH
T1E4A8336BA950EE67E526613607C1E70A9F50787477020604AEE8E46E3D7B2C27B3F1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  EpicInstaller-17.2.0-unrealengine-04b5b611b9934c2aa568d53c4dc14832.msi
- Size 194.0MB
- SHA256 bdb77e87b9d666634e182ea42482d9559125ca8e62c2399b8ad2c6b42395aaa8
- MD5 392f66528c31a402484379f57d0605a1
- SHA1 40d155146d49258d3f3e3d8bacc6c919ad8c1d35
- SHA512 24924b00dc61295ff9fd8f003addaa2f56e6774d2b6e20c068d0d538f0c2b1e2af9c6ca117b9718513218734596a93540e8674294ec67ea91f4dec865b473600
- SSDEEP 3145728:HyCHcktJLbo4ZW0AF7PPMQxSkn2XbtOk1Ne4rkq//id544fVHBo9LE5XCJuo:Tc81WtsXk2XbcPdij4cJE5XC
- TLSH
  T1E4A8336BA950EE67E526613607C1E70A9F50787477020604AEE8E46E3D7B2C27B3F1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Renames multiple (106) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1