Extracted

Extracted

• • Target
    6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af.exe
  • Size 478KB
  • SHA256 6a22220c0fe5f578da11ce22945b63d93172b75452996defdc2ff48756bde6af
  • MD5 deebbea18401e8b5e83c410c6d3a8b4e
  • SHA1 96d81e77b6af8f54a5ac07b2c613a5655dd05353
  • SHA512 a0396c82fb68cf3931f0a2fcdba580d51ec6069c82b4e3853341fc6971a4bde4dbeb0094b94379d1dce4b1d8c43703e86266156ecbee89f9c939a71cafe9d487
  • SSDEEP 12288:2GOrdqXg+Hy7WxHXkzYHD9Fg0CNDG+X9MOguRTzxH/F:EjuSWxHY0C5PXmOgEhN
  • TLSH
    T16DA4020272E18035FDE7063224645A4110FEFE225AE16957BFC7118E7A2F2D05BF9BA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionmazeimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Windows Defender anti-emulation file check

    Defender's emulator always creates certain fake files which can be used to detect it.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2