d40ffce0ef02ad2efba6a982ae0e18110d239d602c97a325644e8e8995b714bb

General

Target
Blank-main.zip
Size 12KB
Sample260831-2elyessxdw
SHA256 d40ffce0ef02ad2efba6a982ae0e18110d239d602c97a325644e8e8995b714bb
MD5 5eefc7125e550a11af219af65caae7cc
SHA1 6dd32a451a1fa518c605be84be17586c6ec52e34
SHA512 af68d523c35a38fa24f42fb4a79574132939892af80e68dffca97ff0251deb0ccbd491b87f663be3411d44aa1674db82c7bdab678d94354bb1c108173b46523d
SSDEEP 384:gghnbbObZ4qXB84dfx9kJsZyM2QNyf6jes6k:JqXzfx9kJswM26jjeU
TLSH
T17542AFA521D56CA2C52F017AC00312BF763ADB875A2E179C76F72DA0425E1EBFF0162D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Blank-main/Builder.exe
- Size 2B
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Blank-main/gui.py
- Size 38KB
- SHA256 2541224e02dea793417cb301ee3de7097641b376df779041ff105cdf79692f1b
- MD5 d4516f5f779e1f422bb4fd3f204e1f2e
- SHA1 35c7d2e3ce191b9d67a149f378e249ae419acb43
- SHA512 704fda769a2cc70388f6ca77bde23506862e9e9fe170c8f5fc79b6ca63156f6fa6a55e9dfa763e4b7fb24ed0b5947a7b568b51a5ab167acace8a20c2b9cc396a
- SSDEEP 384:rRBBxtptPNbwhxFGbqWtYh6tr9f2L+vMPNPtLoPjW6CjLKabA117TDtOycaiC7a/:rRxRNbwhxFGbqWtBtoRvL7JwaMwY8
- TLSH
  T1EE0396A6C72C6A3E1973911DF5462C839D1CD9B3232E45623CFCA27822DC453D2E6E99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Blank-main/install_python.bat
- Size 749B
- SHA256 396f1f4e3a1a19acb953d4acd57f11532debee7712124f36c11de96d32c01899
- MD5 6e8d591fd86324439a6d425c37200e20
- SHA1 cbe16b2a45caa56130b294a6975f929b8cf2997c
- SHA512 a79b2dbaa435b2bd80210a66d9aa12eaf703f26e0ed5fb3383616739ea3e12ec8636d01983c9b13fb893bf2b82ae555780058917ba2e31f8a4cf418e5016660b
- TLSH
  T184017B23C32CD4ED028968FBD922A693BEC7A3DCC4A821949179EAD84C46A04045B1B3
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6