Overview

overview

8

Static

static

3

Spoofer_Ke...er.exe

windows10-2004-x64

1

Spoofer_Ke...er.exe

windows11-ltsc_2024-x64

1

Spoofer_Ke...ss.exe

windows10-2004-x64

8

Spoofer_Ke...ss.exe

windows11-ltsc_2024-x64

8

spoofer_entry.pyc

windows10-2004-x64

3

spoofer_entry.pyc

windows11-ltsc_2024-x64

3

Spoofer_Ke...ui.ini

windows10-2004-x64

1

Spoofer_Ke...ui.ini

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Spoofer_Keyless.rar
  • Size 36.6MB
  • Sample260907-q9extaar9z
  • SHA256 6f62f50e90fd2f26f190486a49eb6923685f379e149fc2f1d565327691928c67
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistencepyinstallerransomware

Malware Config

Targets

    • Target
      Spoofer_Keyless/SMDSpoofer.exe
    • Size 29.9MB
    • SHA256 6b4032b9d7aaff390af357177f4ed6516af9154f70311e0e1b04fdbf9aeda3fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      Spoofer_Keyless/SMDSpoofer_Keyless.exe
    • Size 11.1MB
    • SHA256 36ce3255ef94cdf432e792554abbbbc8f494a42f173f599e4572f30c630a379b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionpersistence

    • Drops file in Drivers directory

    • Installs a root certificate to the trusted certificate store

      A root certificate was added to the trusted certificate store using CertUtil.

      defense_evasion

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral3behavioral4
    • Target
      spoofer_entry.pyc
    • Size 17KB
    • SHA256 68a5315d670b6f276d41db636d44a611d2dcba0cf31d450155829f074f54387c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      Spoofer_Keyless/imgui.ini
    • Size 53B
    • SHA256 1e21059a351147e54cfdaca82ed646444088932581ca4b6fac73152495367f13
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks