General
- Target Airstride-PDV-Setup-0.8.57.exe
- Size 124.2MB
- Sample260913-xpakxssbrf
- SHA256 5dcacc7b928be46b6b8dc2260242391b3846fac9c322af6db3e714d1ab67538e
Score
10/10
Malware Config
Targets
-
- Target Airstride-PDV-Setup-0.8.57.exe
- Size 124.2MB
- SHA256 5dcacc7b928be46b6b8dc2260242391b3846fac9c322af6db3e714d1ab67538e
Score10/10Family: CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Obfuscated Files or Information
1Command Obfuscation
1