bbf27e59c8658273cd5aa912c24b0d7fc3753d0777b249e0f2f9c6c88a765878

Sharing

Copy URL Twitter E-mail

General

Target
bbf27e59c8658273cd5aa912c24b0d7fc3753d0777b249e0f2f9c6c88a765878
Size 485KB
Sample260811-2ssccsteje
SHA256 bbf27e59c8658273cd5aa912c24b0d7fc3753d0777b249e0f2f9c6c88a765878
MD5 b7989ae6c7ac88f6de292899f0f46dc7
SHA1 b36fc77fd16c3ee72e7e3b5034ddef9ab6534001
SHA512 7883208a1cffedcf08e543828ac916fa0a938231d34646ed9b4c8fb58652d5adce2476ec2f42cf6c13219ba75a5b408fc0c4a7eb1b14a6e761eca2622ad4f11f
SSDEEP 6144:2OKRNrzD009x4f9FHcG/DSuz/4JmqvUcNIiyBZvkFwY7orJmz7FX102+X2YFRo:MVzDR9xw73VgSYpyPWErJmjR62Ao
TLSH
T16CB4097EAED556F0C10142B222BF0B8B4607C541527BF98E3B94118AE9577EB4E07BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/1 Delete Temporary Files.cmd
- Size 276B
- SHA256 036d70f53708ed49388f07d0d3f8eda85fbad9ee025c50e6719a331348f9238c
- MD5 28f482a3a59bd431e6437c4e3b24331f
- SHA1 083b5214ba0099e1d952990dd2ceb9cb755216e2
- SHA512 6c291b9ebffe281a5d14a16b2ded4178f7f33c5f4b4eb35680cd9587a072e33e7ce64a4a3868a63e4314e6c4023d6db2f2996392070e7ddd98f1c572eac53b26
- TLSH
  T1A1D05B042FE504F64B640729155F550345487F8FAF99877105422115EF85C511FB43C6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/2 Delete Log Files.cmd
- Size 51B
- SHA256 263796601565da182d06a1ceefde01a91f81dbf698fb2f2fe82f5ef2a858c643
- MD5 fe6269312a5acb279c81fd4e9c07706b
- SHA1 61fd269f2fe171ec3a1351105a4d55de88d322b9
- SHA512 6fdbaed31112138769e146e633be3074505a9905e05c8d4646e10e576cd89774503b678cf3b2fff3600bc03329c682d0dea408830eae569459c1621446dc0add
- TLSH
  T1CD90025B32082E54565904457ACD028464291182114058A95423C072ED816B44105AE5
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral3 behavioral4
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/3 Delete Windows Update Cache.cmd
- Size 156B
- SHA256 d8db1819aa1cc8f7de051b87ba63f1ffc6f9abdb87f663ab4ea38fccade67e8f
- MD5 3fff6672caa88aa36c2f678172763297
- SHA1 8fa103c8f3f1b856c60618f52bf67a997daefccf
- SHA512 d208d92e6df879b60de0415354b68a7f09d7e91382d109352de05e310fe525a58fa08e9557e5ce9c8f0b2d53cbd377541d4b3ca44a71cd6005a9d9e0a5c02793
- TLSH
  T1D4C08C56B802DA63C2F10C0A922E0120EA33B1CAA60004BD03918223BC0C026953B2C6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Deletar Arquivos Temporarios.bat
- Size 228B
- SHA256 aff91a4ea10ed45c89fd9f3a458750b6e8ef20fc1f183badc9f8146db96aa097
- MD5 113d18ab90d083d64af29e80c86a6c49
- SHA1 daf71c0f1a767b4f3011fe6d68b369d284dc0357
- SHA512 4dc0b89012da0167f9a5872a1e28beb56ff7807814f0d1bedb0747ff29006a7d971b6fbad9e9df4751f15b5eb21b0b4704e201989cab36f1dc27c8626ef51d44
- TLSH
  T152D0C7041FE505EA47580738159F960309487F8E9E9D877105411114DF85C511FB43C6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Deletar Arquivos de Logs.bat
- Size 51B
- SHA256 263796601565da182d06a1ceefde01a91f81dbf698fb2f2fe82f5ef2a858c643
- MD5 fe6269312a5acb279c81fd4e9c07706b
- SHA1 61fd269f2fe171ec3a1351105a4d55de88d322b9
- SHA512 6fdbaed31112138769e146e633be3074505a9905e05c8d4646e10e576cd89774503b678cf3b2fff3600bc03329c682d0dea408830eae569459c1621446dc0add
- TLSH
  T1CD90025B32082E54565904457ACD028464291182114058A95423C072ED816B44105AE5
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral10 behavioral9
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Desabilitar_Servicos.cmd
- Size 1KB
- SHA256 f0c263cba371d8655ce5b551bbfe36ea5f9991baf204a7be428d5c483eac3b88
- MD5 883d6b95f1dd95e5a17febc03735152e
- SHA1 23c76b6bbd615934d309c0f6df0161a2dd8f19a6
- SHA512 23bd52aaf707f542da4f2262a0ba0f161ffaa853241c5b27c9f377f81f1d50e64a6ff84c6a6db31702ef9fb4ffef532da4ee9032fc1f7bd173ffadeb1f0b60a0
- TLSH
  T1DB11427974EE3E3BDA4F9724D7635BB3933D9294C0E636562BA8F60908D980D4448F12
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion execution
- Stops running service(s)
  defense_evasion execution
behavioral11 behavioral12
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/LIMPEZA 2.BAT
- Size 448B
- SHA256 72b4a4ec88ee7be9fcb7da30af553821556db244b32df6907a9f6c0ea52bb2c5
- MD5 a7e38a8ca9bc65cd358e91e1792876c4
- SHA1 604b10ea4ae7504c5b524f7b3f334dd750ad4a80
- SHA512 645c312fe0604acd50efb6460c392437bf2173955cbc5668c287603ffd2930ea62c331066848d1bae9d04716dd204a1763d16dd99fd850ecf3d58e964774cf1a
- TLSH
  T151F0AC0C11E4DBA089714C6C57DF3A7380CCAA450F285D05C78241B069898B7F267DD8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/LIMPEZA 3.BAT
- Size 334B
- SHA256 332e76fc9d31431ba53dd009b7ae147ca08d62d85f9ef3e7a54c186cdbac4048
- MD5 1baddd0eb628e864a5321df697ae329f
- SHA1 a447469e6cea2a66cb77dfc9f38549cbc3532334
- SHA512 62bfc6d01d825b1da9904a7f9bcdb1bbbc17defd22b4212d383ce8bd62c89e27a2f1bb8d61d2fbdceec9f38da89501606c17db555cd3f8a537712593626aa1fc
- TLSH
  T135E04F620FAD04D70F08995F600AC5528CE042FE9A52681F8EC54888D734A5109ADECD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Latência.cmd
- Size 267B
- SHA256 9356e1892f635ee36ac88c43834ccd03e218415deeb4720fffc96e3daff3089b
- MD5 6a8ec0009b51fe189a867adf03f3063f
- SHA1 e99594107fce507a4bb0e06ab64825fe8601fda7
- SHA512 527d7d12407d65a6e0ff1a0ed2b9ddf2ddc19e61278d6ffe8d21c3181dfb70035f797efa5f8dbf4fc0eae0d44d4f45738f8a9e116e5ba3e1d2596f87f23fc96b
- TLSH
  T103D02B3736017DB10E438C036BFCB000BA159003D592687874A325FD5C7A094EE9CE30
- MD5 SHA1 SHA512 TLSH
Score

9^/10

evasion execution ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
behavioral17 behavioral18
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Limpar HDD ou SSD/Limpar Disco.lnk
- Size 1KB
- SHA256 082ad7940bd4002167eb58f55d8bcd073d2f72b29d83ff64c752feeeaa45b881
- MD5 c55847413ad9bc79a6e319166bf5430b
- SHA1 b1d8963a0c891e17af115e9c785ea26893c7106f
- SHA512 386bb17894a8cd3ee0e9d5813cd29560ecf263e5e9717f11cad0636ae4979815acad235330e4f3e8ece9b121a3b5caa239ba754d1323bb1a81a28b5c6a1d5cc6
- TLSH
  T129219E1E52C52B2AD7338A33507BF341DA72BC25E9A64F5D418056CCDC65118EC61D7E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  otimizaçao gnomuh 0.1/ULTRA OTIMIZAÇÃO SALVA PC/regedit/Sempre que ligar o pc/Limpeza De Serviços.bat
- Size 784B
- SHA256 13417a9f8069db2ef364fceb14ae8f7fe8677b33233d5a875ae279d50376fd89
- MD5 b181bd58d14e911789130277feea4ee2
- SHA1 75a42db5cffaeea2e987d72f8e645b69f3f01a26
- SHA512 b1672b662e57abbe93386945903b22e9ccba0ccfbf1c05b53b0ae8bc1e80d692066f0ab179fc033edf091020eb5a63a90bdb744c5e67b75456961f3af9766b10
- TLSH
  T1B60104090AE896D14F304C2D638FB63288D896DE0F251C0BCBC244A097599A3B66AEC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  otimizaçao gnomuh 0.1/comandos para exec/DELETAR-ARQUIVOS-TEMPORARIOS.bat
- Size 824B
- SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
- MD5 b741f2a2026378cfc69acc3393eba109
- SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
- SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
- TLSH
  T1AC016F1D2994434185B11D1D9BFF72726488D5431B2C0D03879695F0A946AFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  otimizaçao gnomuh 0.1/comandos para exec/DIMINUIR-IMPUT-LAG.bat
- Size 942B
- SHA256 aa4e2f63da07018bbacbb8c74e94ee6a8119b54dae10cf97b9fc0a1f29153ca6
- MD5 f5536be709d1b50cc81ffb7cf9a898ef
- SHA1 461173129b2ab01996677347c64784d102499e78
- SHA512 2afacd3c13c5077f495d8007ed121c9b20c86b64ca09f5331bafd67e42a5362f3bffea91471c1aa58ed12fac03b83b94192933f781f1303edc53df9959cc3abc
- TLSH
  T1EB1140031657AEF68505BC07BC38FA05766CE80391B5F4EC706461E094BE2A9CE766F0
- MD5 SHA1 SHA512 TLSH
Score

9^/10

execution
- Modifies boot configuration data using bcdedit
behavioral25 behavioral26
- Target
  otimizaçao gnomuh 0.1/comandos para exec/DIMINUIR-LATENCIA.bat
- Size 137B
- SHA256 90f005fb3a60842cfc4bc760528ea846d3d2885a1deedddad06cb2369707d12c
- MD5 bd82f47a498ab0d4922d3888ad2fdc4b
- SHA1 b2c83fe7af2f41acf94d5b8f026adaaacd1c619e
- SHA512 4015c953b2dda30330fb2fd51198c8aec902f78d94943e10c87ab822b6de1ce539ed98c7ffa3fdda2d93469a049fe66d30e9a64681b9960c324222aa38f0f85e
- TLSH
  T14FC02B10CA1E4063C5A2B11024D3C8274FFA0B073493D7003CC8F014413B08780B67C3
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  otimizaçao gnomuh 0.1/comandos para exec/LIMPEZA-COMPLETA.bat
- Size 824B
- SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
- MD5 b741f2a2026378cfc69acc3393eba109
- SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
- SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
- TLSH
  T1AC016F1D2994434185B11D1D9BFF72726488D5431B2C0D03879695F0A946AFBFA3ACC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  otimizaçao gnomuh 0.1/comandos para exec/Limpador de Cache.bat
- Size 818B
- SHA256 23fcccb30f22d62fc0298cd5b30438bdbb1306ee805d7eda9c9f89cf0f8d1390
- MD5 2c2fa1a1b68ab3009c4005796c5fe33b
- SHA1 c99e99b62fe3e5319805a3652ba9c0b9d2281788
- SHA512 083f7171e7e9f0e7f7b74aac33d3daf4848780b50dd1e0db00442a023007e372bada84d14bd1a9f290dcfbc7869ac30cf6d94cf747f37edc89019c11689193fc
- TLSH
  T18501AB2D2598430195B11D2D9BFAB3726088D6431B2C0D029B9A85B0AA16AEBFA35CC4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32