rahiwi | 0ad301ab73172ce423f3d12fd392d21fd7aabd185d85ae806b45c61f8efd8cbf

General

Target
0ad301ab73172ce423f3d12fd392d21fd7aabd185d85ae806b45c61f8efd8cbf
Size 272KB
Sample260909-sqf2waxdlf
SHA256 0ad301ab73172ce423f3d12fd392d21fd7aabd185d85ae806b45c61f8efd8cbf
MD5 ddf5e9e2a4aa9eb9e4b7b5799a863d6a
SHA1 439d2b41d2b1586550cd685e11f6c1140f0ea4c2
SHA512 edcddd808afb5c4972b30b1689ee8cf777e313e92badb476a6c1ab9eb2ded76904e5971d322a606f63714229733e1facecf8e3c05ef4d75ab06699c5c9a0bcdc
SSDEEP 3072:+MBGBT753Q+RgWgMlIx1ZiXjb6aEF6D0NM9voeLNZ2j8Cd2:Pw753RgWg4aAXjb6aEFfooeLNZxC
TLSH
T15C44C416BA12841AF691C8B53925D1AEB9197F322452BD5BF3913F4B34312D3B1F2B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0ad301ab73172ce423f3d12fd392d21fd7aabd185d85ae806b45c61f8efd8cbf
- Size 272KB
- SHA256 0ad301ab73172ce423f3d12fd392d21fd7aabd185d85ae806b45c61f8efd8cbf
- MD5 ddf5e9e2a4aa9eb9e4b7b5799a863d6a
- SHA1 439d2b41d2b1586550cd685e11f6c1140f0ea4c2
- SHA512 edcddd808afb5c4972b30b1689ee8cf777e313e92badb476a6c1ab9eb2ded76904e5971d322a606f63714229733e1facecf8e3c05ef4d75ab06699c5c9a0bcdc
- SSDEEP 3072:+MBGBT753Q+RgWgMlIx1ZiXjb6aEF6D0NM9voeLNZ2j8Cd2:Pw753RgWg4aAXjb6aEFfooeLNZxC
- TLSH
  T15C44C416BA12841AF691C8B53925D1AEB9197F322452BD5BF3913F4B34312D3B1F2B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery rahiwi persistence spyware stealer upx worm
- Detects Rahiwi worm
- Family: Rahiwi
  Rahiwi is a Windows worm written in VisualBasic.
  worm rahiwi
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1