07be8ec1a15f4ca3af354ab896ca16099b4e80edb6b7ec193604e091291b442a

General

Target
Euphoria-Install.zip
Size 121KB
Sample260811-1hvjasdn5v
SHA256 07be8ec1a15f4ca3af354ab896ca16099b4e80edb6b7ec193604e091291b442a
MD5 b7cff25537d9b3fd0808d45292dcbc84
SHA1 4f82af5bc339c86e5ac5242bdbfdcd76530a635d
SHA512 9dba5496cc43722fd9bbfb422873263fbb057185cd8648090175c28d33cc0210790ddc75f036db75be76ad56014aab5410366b666e4c4ea6c670d2285d579f0d
SSDEEP 3072:fd+zCIXKcGCIze5GuGk3ByLZ8iPZL2SNeR3U/X49e8Kwo:fd++I6oIy5ckR28iPZ2kPiefwo
TLSH
T1C3C312D3DB2D984ECDABD2B2A38475D5FA61F192BAD74401265FE33E007B4C18349826
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Euphoria-Install.zip
- Size 121KB
- SHA256 07be8ec1a15f4ca3af354ab896ca16099b4e80edb6b7ec193604e091291b442a
- MD5 b7cff25537d9b3fd0808d45292dcbc84
- SHA1 4f82af5bc339c86e5ac5242bdbfdcd76530a635d
- SHA512 9dba5496cc43722fd9bbfb422873263fbb057185cd8648090175c28d33cc0210790ddc75f036db75be76ad56014aab5410366b666e4c4ea6c670d2285d579f0d
- SSDEEP 3072:fd+zCIXKcGCIze5GuGk3ByLZ8iPZL2SNeR3U/X49e8Kwo:fd++I6oIy5ckR28iPZ2kPiefwo
- TLSH
  T1C3C312D3DB2D984ECDABD2B2A38475D5FA61F192BAD74401265FE33E007B4C18349826
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence ransomware spyware trojan
- Renames multiple (6110) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  VRChat_Data/Plugins/x86_64/steam_api64.dll
- Size 240KB
- SHA256 8abf7afe81ff984c546e19ba62437cf6d90791b6811b48d0ce36a58b5f01229b
- MD5 cd46add52aea5ee1405d7e861c1563d3
- SHA1 fa906b0cfbade7ce050fe7d8ca4c9d33f571ff26
- SHA512 bd2e74a4d9078c6d74b68e4d99282d2bb6827b97c9d37abf6ab50867bf1efde9b23898cfbd7151114a49b9cd391717e6089590c0b5501deb36d8d65b079573c0
- SSDEEP 6144:RXaYGGPkzQZT8W097zLtB1MV06dK+SCKbZIiApv+:kdFRrCHdK+SvZIiA1
- TLSH
  T153347D25BAB508BEE577C57DC9434906E7B27C060770EADF03900AA61F277D49A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4