1853119a7ec4b7e4cad67259dda9b2cdb6f1a382d2a2b2ad85ea3f4fc4ae8ee1

General

Target
Aprodite_By_Will.zip
Size 92.6MB
Sample260905-s47fzsen7v
SHA256 1853119a7ec4b7e4cad67259dda9b2cdb6f1a382d2a2b2ad85ea3f4fc4ae8ee1
MD5 b42b1c2f147586b556b07cc0cce4e6fb
SHA1 70f65718f06c4956896c3c7d883e156df7be11fc
SHA512 1aa767273dfbdf99e23fdfab7371bc3f9b733b437543a383526a43c9a55668b2c83ec407960810a021ddd9a64ef65622318056e0f524f9b7011210b53f89a0de
SSDEEP 1572864:OfkPEIQmUnK/PDWPQKbh6/NQpjmRXAg4ifR5GX3AljuBNlKDLPulA450EcglBqGb:sk2ml/bWPQKb8WpjmRXAg4ZXqjwNlK/I
TLSH
T1152833FDB69E9EEF77054DB0C7D3B240C86AB2D91B036AAA3ED183D506EF4149C49910
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Aprodite_By_Will.zip
- Size 92.6MB
- SHA256 1853119a7ec4b7e4cad67259dda9b2cdb6f1a382d2a2b2ad85ea3f4fc4ae8ee1
- MD5 b42b1c2f147586b556b07cc0cce4e6fb
- SHA1 70f65718f06c4956896c3c7d883e156df7be11fc
- SHA512 1aa767273dfbdf99e23fdfab7371bc3f9b733b437543a383526a43c9a55668b2c83ec407960810a021ddd9a64ef65622318056e0f524f9b7011210b53f89a0de
- SSDEEP 1572864:OfkPEIQmUnK/PDWPQKbh6/NQpjmRXAg4ifR5GX3AljuBNlKDLPulA450EcglBqGb:sk2ml/bWPQKb8WpjmRXAg4ZXqjwNlK/I
- TLSH
  T1152833FDB69E9EEF77054DB0C7D3B240C86AB2D91B036AAA3ED183D506EF4149C49910
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Aprodite_By_Will/Aprodite By Will.exe
- Size 164.7MB
- SHA256 b4767ef7c6cf64942826b96b488f74e2213ba433f2d887508be8c6372bbba423
- MD5 d378959db6833cb4d6956ea7a611d121
- SHA1 74d1e3b5720fdfa2c19610d760092041842b4933
- SHA512 04c6a0035095b448eb3f4ec50f53467fc2af622014f1fa5d716ebf3145217ac6bb162150f04f97d4273db63c152390b436a10473d8bdd5eca4449b0198ec4abb
- SSDEEP 1572864:bmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:DsFWY7ihS4kVP
- TLSH
  T1C0888C03F29650E9F05DD1B18B578236EA72B8861738A6DF175417262F7BFE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Stops running service(s)
  defense_evasion execution
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral3 behavioral4