255742e073491571083d13102efa262d36b7e765f3e5bf0231dd9d4e9ca28d54

General

Target
stuff.exe
Size 16.9MB
Sample260831-tb4eascm6x
SHA256 255742e073491571083d13102efa262d36b7e765f3e5bf0231dd9d4e9ca28d54
MD5 0a2b03d875f8c1a5c998468e26a9fa60
SHA1 8e167937f8e74d571e4af9e82bee041692beb4b3
SHA512 5e55679c930f66f8811a820164a9541f9f30e7959d8e27836d0424fd62946e5d0a3d16b67c1e970fae5d7d3d9d30d7493177d7888654d380425633edb38e2ad1
SSDEEP 393216:vqoIuQXEAphVtB510MjyBrnpASVKaT/vUr5W5B:vqoIpRphn10Mk7mtabvUr5WD
TLSH
T17C073368BB4000FBE5FA503D58A2CC62E6F276570B91D2EF17A012652F7B5F09E3DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  stuff.exe
- Size 16.9MB
- SHA256 255742e073491571083d13102efa262d36b7e765f3e5bf0231dd9d4e9ca28d54
- MD5 0a2b03d875f8c1a5c998468e26a9fa60
- SHA1 8e167937f8e74d571e4af9e82bee041692beb4b3
- SHA512 5e55679c930f66f8811a820164a9541f9f30e7959d8e27836d0424fd62946e5d0a3d16b67c1e970fae5d7d3d9d30d7493177d7888654d380425633edb38e2ad1
- SSDEEP 393216:vqoIuQXEAphVtB510MjyBrnpASVKaT/vUr5W5B:vqoIpRphn10Mk7mtabvUr5WD
- TLSH
  T17C073368BB4000FBE5FA503D58A2CC62E6F276570B91D2EF17A012652F7B5F09E3DA50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact network persistence privilege_escalation pyinstaller ransomware spyware stealer trojan anti-termination
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (119) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Detects potential anti-termination behavior
  Detects RtlSetProcessIsCritical or NtSetInformationProcess references associated with process criticality, likely enabling anti-termination behavior that may trigger a BSOD if the process is terminated.
  evasion anti-termination
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Detects references to legitimate web services potentially used as dead drop resolvers
  Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
  network
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2