0ec8881736114b83e3282ac546703a0a2f9d2a00d532e2a501e8c33437252f27

General

Target
0ec8881736114b83e3282ac546703a0a2f9d2a00d532e2a501e8c33437252f27.exe
Size 682KB
Sample260810-ylrwgaac46
SHA256 0ec8881736114b83e3282ac546703a0a2f9d2a00d532e2a501e8c33437252f27
MD5 81e4e8805aca09cd540e35bcead0490b
SHA1 5a9d015e967928b538b89e005696704e0037b3d7
SHA512 86490d78db736c6111248ded0accd3137b58dba7481ef3fa8b521e6aa47d01873c2c9997a722e66f216b452c7bde6c200646cf37c775df7f60e9f16e539f2104
SSDEEP 12288:p+YuI6AoRmBWiXgqHuJ/DYgDUHb0RiM+iMsdGqxGUyoNWkdqs86UBttgGO9UBQly:p+Yzls+LHZgY7K5VMsXYeldd86E3HO9s
TLSH
T150E42312E364D937E3BA6130056ECD3222A1BF2D52F84A1747B9B31ABDFBD50D486247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  0ec8881736114b83e3282ac546703a0a2f9d2a00d532e2a501e8c33437252f27.exe
- Size 682KB
- SHA256 0ec8881736114b83e3282ac546703a0a2f9d2a00d532e2a501e8c33437252f27
- MD5 81e4e8805aca09cd540e35bcead0490b
- SHA1 5a9d015e967928b538b89e005696704e0037b3d7
- SHA512 86490d78db736c6111248ded0accd3137b58dba7481ef3fa8b521e6aa47d01873c2c9997a722e66f216b452c7bde6c200646cf37c775df7f60e9f16e539f2104
- SSDEEP 12288:p+YuI6AoRmBWiXgqHuJ/DYgDUHb0RiM+iMsdGqxGUyoNWkdqs86UBttgGO9UBQly:p+Yzls+LHZgY7K5VMsXYeldd86E3HO9s
- TLSH
  T150E42312E364D937E3BA6130056ECD3222A1BF2D52F84A1747B9B31ABDFBD50D486247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Caoutchouc.Unp
- Size 56KB
- SHA256 144ca70bdfab8abe347591eb3e32f2c13e23eaf87a0a668f89c82c782a558609
- MD5 fefc6fc1ed5343a603c9c155d84322d5
- SHA1 3633a055beef017dfcc5e091ef8dc39200390082
- SHA512 0ad60cec35317898ab9a561e1d33b8fda26dbee1e6065189393853f620b74760f74062dc23da8f41bb9758ff05f165f8eb93f96e8f2359976c7175b73c730a99
- SSDEEP 1536:+VwIaBdOh1GjCtik63Xz4yoTrmFuInFzKo69JUoZTuFjNeS:fII4hQjCtik60PmAUFM9l65
- TLSH
  T12543E161AB29030C5EC1138ECB4258691F35497DE4BA88E2E57F327B314345D6CF9BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution persistence ransomware adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4