3207e171f061f922b17f23f1c090f61494e98df56a9135e60d29a50c88b63a2a

General

Target
crackedSusano64.exe
Size 11.8MB
Sample260913-n7spsaag63
SHA256 3207e171f061f922b17f23f1c090f61494e98df56a9135e60d29a50c88b63a2a
MD5 b85fd13a9faa4e0ac69500177e2e5b62
SHA1 53e483582090acd4031d5ef426d84092c5388333
SHA512 8f0bb6178adcbcbef706385d4d680e9aff53c15fda14dd387451b1f6ed856bd9f80c29e5f2ff6f2df6474e874d0ed9c5e01804e00e393347c30587d399f7990e
SSDEEP 196608:4EUPUvfauowgMoPrv4QEhs2SV5lT4FMIZETSrjPePdrQJ/Bk8fCnPS4OKJsSFBq3:VUcvfBgNTv4fShTQETSrvJKACawBo
TLSH
T141C6339BF0A28FD4C14585B461E52DBC7C3388FE6FA8724A44FAA0D820D7916693FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  crackedSusano64.exe
- Size 11.8MB
- SHA256 3207e171f061f922b17f23f1c090f61494e98df56a9135e60d29a50c88b63a2a
- MD5 b85fd13a9faa4e0ac69500177e2e5b62
- SHA1 53e483582090acd4031d5ef426d84092c5388333
- SHA512 8f0bb6178adcbcbef706385d4d680e9aff53c15fda14dd387451b1f6ed856bd9f80c29e5f2ff6f2df6474e874d0ed9c5e01804e00e393347c30587d399f7990e
- SSDEEP 196608:4EUPUvfauowgMoPrv4QEhs2SV5lT4FMIZETSrjPePdrQJ/Bk8fCnPS4OKJsSFBq3:VUcvfBgNTv4fShTQETSrvJKACawBo
- TLSH
  T141C6339BF0A28FD4C14585B461E52DBC7C3388FE6FA8724A44FAA0D820D7916693FD17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan upx discovery
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (1135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2