eef9c776ccd79f332e4a5f9a7dd9efe077fb5553e2cc716af072f7d50412e178

General

Target
hi.exe
Size 29.7MB
Sample260817-31stjascjb
SHA256 eef9c776ccd79f332e4a5f9a7dd9efe077fb5553e2cc716af072f7d50412e178
MD5 bbf947ba47452c013434f76e9efe8df6
SHA1 d89510bc8fba3c042a38e5420ead2c2219548d55
SHA512 380d46ce5766ba468ecd75726bb226bc2ab0e502d0cb5d2e4aa2b9e1bc83e3ebfddc5c576b41de858c8b67719a3036d6b64ad573f390d8f2ef2bec5b46315bf8
SSDEEP 786432:b3GwSEGC4W831QtIyOjTNGCgeNscuAVsMcf2I7+e:CwSE+WSiIyK4cN3ZVKT7z
TLSH
T1A16733957B8A0468E4D9917AE2C8807BAAD634AF0334C4CB5BA11D470F372E5FF36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  hi.exe
- Size 29.7MB
- SHA256 eef9c776ccd79f332e4a5f9a7dd9efe077fb5553e2cc716af072f7d50412e178
- MD5 bbf947ba47452c013434f76e9efe8df6
- SHA1 d89510bc8fba3c042a38e5420ead2c2219548d55
- SHA512 380d46ce5766ba468ecd75726bb226bc2ab0e502d0cb5d2e4aa2b9e1bc83e3ebfddc5c576b41de858c8b67719a3036d6b64ad573f390d8f2ef2bec5b46315bf8
- SSDEEP 786432:b3GwSEGC4W831QtIyOjTNGCgeNscuAVsMcf2I7+e:CwSE+WSiIyK4cN3ZVKT7z
- TLSH
  T1A16733957B8A0468E4D9917AE2C8807BAAD634AF0334C4CB5BA11D470F372E5FF36B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  hi.pyc
- Size 21KB
- SHA256 4c66c86518cd871498d6ea40f134322b56b804c6ae33209f1a2799cf4763ef1a
- MD5 4a2d5172d77161f5b8392034316c793f
- SHA1 6ddf681009fab1c37bf89a3cc8527726c113eebe
- SHA512 f96955c58516361ca55f4f819b70bb43d4c07e2754a35a4e6db892f4ed4e377a9d9b009f1406e8b9ce9cc7157369f2df81ab5de56460088b400d08c2305fa94b
- SSDEEP 384:CsxnQycRu9MsjX3dfbKe9Kcyno4fIWPvuAVzrP9SVCpAx2:xVQnRuPRt9ioSIWprcVfx2
- TLSH
  T1FDA2B5862692C873FC16F2B69813270AB364CAF1A204CF132361D12EEED6F547D646DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4