1678ef389ee9cd52c5101e8bad489623e01d0882948bac8b93b79456825e34c8

Sharing

Copy URL Twitter E-mail

General

Target
setup_epagesaferrt.exe
Size 20.6MB
Sample260916-y9531adh48
SHA256 1678ef389ee9cd52c5101e8bad489623e01d0882948bac8b93b79456825e34c8
MD5 c8b32f8be71666614f6117fd8d651dc6
SHA1 68c2e3523dd18b62297a79ebd9ddf77a2d520126
SHA512 5c319cd753ac96f1becea0c451d0cfd1219e387e6d8199072a19d9ca67ba40aff5e20b3667451b4f70aa9f33ff20579facaa6041c360c16903c11ce17694e37a
SSDEEP 393216:1TA+FnP7yRgvy6hwaiVVIxqotIh9cjk7ND3EbPL+xgNATAbrOJXRQ:RAwnP76T6+aiV49tIncKND0bPL+iBOJi
TLSH
T1D82733478964BB63DA025939537077FB9FA3CC03E624D467E7ED3B11DA200BA1BE0691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  setup_epagesaferrt.exe
- Size 20.6MB
- SHA256 1678ef389ee9cd52c5101e8bad489623e01d0882948bac8b93b79456825e34c8
- MD5 c8b32f8be71666614f6117fd8d651dc6
- SHA1 68c2e3523dd18b62297a79ebd9ddf77a2d520126
- SHA512 5c319cd753ac96f1becea0c451d0cfd1219e387e6d8199072a19d9ca67ba40aff5e20b3667451b4f70aa9f33ff20579facaa6041c360c16903c11ce17694e37a
- SSDEEP 393216:1TA+FnP7yRgvy6hwaiVVIxqotIh9cjk7ND3EbPL+xgNATAbrOJXRQ:RAwnP76T6+aiV49tIncKND0bPL+iBOJi
- TLSH
  T1D82733478964BB63DA025939537077FB9FA3CC03E624D467E7ED3B11DA200BA1BE0691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution installer persistence privilege_escalation spyware stealer trojan
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- TLSH
  T10881C5436B102FBBC0880630358E7D1E64FA49A8536E00BFD786A98E3DD62D4F170367
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/MaImgsfCheck.dll
- Size 22KB
- SHA256 88fad6fbb302770211fd4427864d9158b89825504bc77a396529c80e9fab5156
- MD5 cb6b37ed77a1010ea087edbaaa9355f6
- SHA1 d55a3d539d64c501233abfbebbbe9dd5f1e004cb
- SHA512 53eda5c4e9d41a9e7cbb01e77387df501159e1e8520be030e0d956527e11edb2ca25bab167da50837ff105ac30a0d562d8b940833be4b311baec7a69e24ca7df
- SSDEEP 384:iK68saljcAmJNSVgVWyQ6tXldqZJ50WVrBWgBZDJJ3Nq7Y1KQ5:iK6da5cAIxv3bSJSevHDH387qKQ5
- TLSH
  T132A26B225F1940B3D65E0474BA75FF2F0A397E011FE029CBABD71DF52D660871939A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  $PLUGINSDIR/MaPlugins.dll
- Size 20KB
- SHA256 45d24ca2fd9a0f6603365001e770a5e1d0103caa32d9667dec55d26f3598d110
- MD5 5450157ded399912b02d03aaf03053c2
- SHA1 4f7b7f20256fb5b98cdc75e7ae892600f8232383
- SHA512 41d59ab9ceb0fd7350569c72170614c874bc2c72cde7f77311337969f85ff47da9f9f193e729aa6082da330956c9ec19a58a66747711ddc6eff4a7aa7e39ffa5
- SSDEEP 24:e1GSL7WM7UllAlopjYOvf3pApRlaMAHy0WVFGh5U8:SLv7UkWjYOnpuRwMAKP8
- TLSH
  T1DD92023763B08EF1D40A1B7614470DA662EF963813F1100D9D59642B6E706BBED38F01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  $PLUGINSDIR/nsJSON.dll
- Size 22KB
- SHA256 6785ab17a6c27be18072aa1c274078321b4ea27bfa752d3c882ec3093dc4637b
- MD5 c8222584e91b74c47f5ce2a84d1cdc4f
- SHA1 750359dd536c840b1d4016826af7f34a8562e242
- SHA512 a89f0083c791e7d4d54fd728e848e44bd44ef9e11c799a48ab95a48d3c4e02e68699e28818c1232b694120973ac0c3e418740759830ef70d328d7ef9e5789f51
- SSDEEP 384:qdctoQMA9RtBHo45eqtTv/lddWUn89tNj5AYXqUYevrTZg9MyhTZrdSw:qFqRtBneqtTXldBn+tNDqqz1mMIrn
- TLSH
  T15AA25C56A17068F1F92614B5B9926E232F7EFA083475989BCF23196D7950823BF3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7
- Target
  $SYSDIR/$R0
- Size 204KB
- SHA256 ac660ed059b42d0c63ef2b3b84437035ecacaccf011b70ceccc91bafcfea5c3f
- MD5 36870ea9f9e91dfe5c13f45e8f54053d
- SHA1 880779c2b78e5dbf99ad127c4a1f06c713de7fc0
- SHA512 100075b8a978cf046054253229e3738a8a03a999606ebb4f9695c81adc0e5faf733b358fb8b304d870dcdbc1bc0117a701d01bbb9f3b213f8bb8799f80ef4625
- SSDEEP 3072:TpVyUJciZgllNpSDoTacb/E5TBfnd77g51roWgWR:NVRJciZgllNaopb/E5TBvd7402
- TLSH
  T1F7249D01B640C573D4AB053C44A9CBFA5A7AB13943B8D8C3B7887FB66E953D066352CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  $TEMP/Inst_MaEPSBroker.exe
- Size 4.0MB
- SHA256 92610b0132612e462f58dc17751cfc3d30d79ae5165ceb50f8a8b190019ce063
- MD5 c5f3f1102c090da7e8661878db34074e
- SHA1 91e68b8cce2cefb493edeba65dc2234030eb6bfa
- SHA512 fe6c782cd796b253f47b1dea8712f4e44e87697ea0161438b9d78afe856a213ae78bb10367cf3308f76c2a346b73c4290e559c5d767d5ea70d667d86ef1e020f
- SSDEEP 98304:r/x5Xl1jcl7mFsE8Nj/7T7UA1gdgmsQcEr/1D:r/x5V1I9gbE/UGgdJsQ/rd
- TLSH
  T12B1633476614D61AFF02663C32705D7BCF8728196280C58E5A0B426BBDD16BA8FEF0D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Adds Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
behavioral9
- Target
  $PLUGINSDIR/MaPlugins.dll
- Size 9KB
- SHA256 2493fb5701a61ef0614756f3729b1637b61ed1ae194aa1972b7fd5b1381f1f81
- MD5 c29d7c5e69585ee986e4bcbbad015ef8
- SHA1 99990898e13fcc8416e2a47a121570c0debe47d3
- SHA512 0b251fee20fbc853309540e17c252854c3fb98fd96c8c8f343f26702e0d6dc03e9498c2fb12cf9781cd20cb82b0219c6708f28849de82f389f2911c59ea559f3
- SSDEEP 192:gXNDM6uB3FxUXt1R4urF1TO53X+Eq2EO87a:gNuB1xWR4eTOFuG78O
- TLSH
  T1AE120939EBD74062F66A0EF2AF9242D60BBC291337E6207BFB4104D90DD0684D8B0332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
- MD5 fbe295e5a1acfbd0a6271898f885fe6a
- SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
- SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
- SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
- TLSH
  T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  $R0
- Size 3.4MB
- SHA256 f50a2c5085cd68384352ffd51ad145d0af20b80d4ac7009c4ff5dcb5ec6508c7
- MD5 605bf1f41579ad3216cc4e91e6b0792f
- SHA1 546ff35f38d7ac57fb168e53dd016a16aed91ceb
- SHA512 171e27ae3cf06e9b3f51483f543fe2c2dbcff4d72960f225e68e02736b8899dab3f88ba270d22628a06cad3bc766a9f27783f7869844d680184d2a7e341a698e
- SSDEEP 49152:G2rzC5pfufEi9kRB/5glPrMESpeLGTSSDaDHQiiqpYdNfhQGQLA88pF/N:G2rGXf0RWRp5oBS9TSXFiJtZQM
- TLSH
  T19AF59D21D7018836F5A705B1447E877F6928BE301364E0C3E3C87DAA55F66E27A3AB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  $TEMP/markany_ImageSafer.exe
- Size 4.5MB
- SHA256 5d594159e5d235c5c84076e4d5fd0ebcb5c8d13fc613b840add27301a75c96db
- MD5 b67266afbfe12eb465f014c09b562798
- SHA1 8dbe1c2105228dc5755efd7b00d4444cf4c51203
- SHA512 3e915a5b7cea594749272945e9a392ffa15f8c4bf313183fd1ad3c6b505ff1b36e46fe5ab8c0e4c51965db031f463774fc64997008a820e75ac3ec099f667491
- SSDEEP 98304:npVZKBwnLNMBL9lv/qmES3jJ8itWLgY43FX20lWhad:npVZPMBnv/EsJ8itXFX20UI
- TLSH
  T1B92633017524AAB7D46976338D2BFB492E1BB9A32E91B81BC3CF9C22DD13241D21CD75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral14
- Target
  $PLUGINSDIR/MaPlugins.dll
- Size 9KB
- SHA256 379a34474a239a118746a67170aa9c3aa22c86ac5b646ed58f2f3023639cc137
- MD5 72d4d22b2f59af9e40333c6c35cd9da0
- SHA1 4ae18123f36e08430de0d8cc934eb45ec4231ea3
- SHA512 ed723e38a1fbe722c216cfbfa94bd8c956ac4e336edc00721adbbec9a015b1bf044121c5f2ea4e84873790e21ee22abdb327b7ed157a6f0d0730adcc56cc4d38
- SSDEEP 96:XZ2XBx18a7e9itv2tgKN5zPdqc5lGm5DNQPBTI3XAp+RqR1xQj8OC7tCETP/z:J2XBx1B69i4ge8cymA5M3X+EqRO87TP
- TLSH
  T1DB12D728A6870126F65A0FF2BE9382964BBD7A1333E6207FF74501991DD0641E8B0776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17
- Target
  $WINDIR/ImageSAFERSvc.exe
- Size 14KB
- SHA256 4574fbdb2cd737eea7299dc98653ed4acb07d710100ffd573c1b6e570a1aabb4
- MD5 3b2955aac1d9fa353e2fe678ef0e1be4
- SHA1 7c9018541e696ce6f1995a945009ca25aa915f9c
- SHA512 ed42410b965e9635648af6df68f711fc49963e776e2504c3ac2da10708c8122fda57ed6c8b5f5a8e00a4edabf4dcd23e7d813285d1cc55a54a70f8134f65711b
- SSDEEP 384:Ivb7hIh0WvVIw5RZNvQe8E9VF2ZsHL74ixZY1R:IXhg08T3CNE97BwR
- TLSH
  T1B7625D15CFD45806EFBB4EB034F9C2259F3572916B60C1F77226C0944B91B8268E53BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  $WINDIR/system32/$R0
- Size 14KB
- SHA256 4574fbdb2cd737eea7299dc98653ed4acb07d710100ffd573c1b6e570a1aabb4
- MD5 3b2955aac1d9fa353e2fe678ef0e1be4
- SHA1 7c9018541e696ce6f1995a945009ca25aa915f9c
- SHA512 ed42410b965e9635648af6df68f711fc49963e776e2504c3ac2da10708c8122fda57ed6c8b5f5a8e00a4edabf4dcd23e7d813285d1cc55a54a70f8134f65711b
- SSDEEP 384:Ivb7hIh0WvVIw5RZNvQe8E9VF2ZsHL74ixZY1R:IXhg08T3CNE97BwR
- TLSH
  T1B7625D15CFD45806EFBB4EB034F9C2259F3572916B60C1F77226C0944B91B8268E53BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  $WINDIR/system32/ImageSAFERFilter.dll
- Size 157KB
- SHA256 4c6655db6e301c14715efc42693f6cf26e5f1e8166dd3680cd5a517d76ed14f3
- MD5 6386a662e6da888e93b7e14ed117baec
- SHA1 8ddec3bac3c6e748aaba1521f8c94b514b84f4ab
- SHA512 0fd0b94d1418045f261f4f2e117191c021b62491911bd4ea71a497be82dc6fa3773ec833b2c2421b4ff6b553056cd3ffaaf759bca259e519d707a9fca43f2418
- SSDEEP 3072:gbM/AyQhiGks7RN3JU8P6sebdcm6AICg/H4OtEmfgB8kCI:V4jRPT5Uvsu6ALWH4OtRzI
- TLSH
  T1BFF3E7007BE94139FABB273E5A766629253B79D88B34D6DF53981A4E5C30BC09C71323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  $WINDIR/system32/ImageSAFERMessage.exe
- Size 61KB
- SHA256 88dd644cd20bfa195e75f691fa95453ca6367a1977844cc019125ad6bc8f20ab
- MD5 1c16b1ef674cedd715d3a65d9581fa8c
- SHA1 73e71c19f73f662748772814454ff0ed723f78a2
- SHA512 e614d34d578dd826dba2dcc76b66a69541202af2610e3a8d878741e26051476879ec24383d4ac378252cce2c8be0152fff0d94f3e0f5cb28143f60cfa2b3212c
- SSDEEP 384:Swvc/M4aVPbt/dSEYF/ilFwOujet1xq3UZU9w1xq3UZU9C4MG:bY0F9YFowOEedZU9qZU9f
- TLSH
  T1B2535F0266018864F35D0B316A16F9E4099A9E3C59E4F18FF57CBE3A6C721D39AB314F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  $WINDIR/system32/ImageSAFERProcMon.dll
- Size 87KB
- SHA256 bc18d1f6d99628dbc9445765b551d4c2c7a0aa334fa3eb7820879c24e017f01e
- MD5 c5bda27ab9c82ff49f62165516f1f03e
- SHA1 381cfdcfcdc4a288c5bf69aed0620f6b220e77c0
- SHA512 de8d344e3e939082f0cf4a24921cdb41d4c9063401169d680e0af1d217b05da0b103ca451f831e4bd6f3f3f72f5692ff111348cf7cd0c796f7636936225f403d
- SSDEEP 1536:cOs+GkKMza8jVrYbcBI6zI6VR9A9eteqSwT9jm/VbhbTbatFFugjuLaGIgICS4A5:cO/GkKmaMIUH9DeqSwT9jm/VbhbTbat/
- TLSH
  T187935A003BE98972FAEA1B707936D70D6279BA614FB194DFA3561B4F0D306C1AC35326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $WINDIR/system32/ImageSAFERRecovery.exe
- Size 72KB
- SHA256 ee6c5fe451dcf57a2feb3e49f8ad607f0132f2e7b06f351c4d3bf102cc0ed8e8
- MD5 1f9b2f80b4ee174ae6d1b9f9cb78b7de
- SHA1 2d9ce48cb469f4963892b1d044d13f973f8ba65a
- SHA512 2a765c5d26127b782747e8e293f3f19c5d8f8208bc62e8cad2361cb0f54fa31ce7fc0ee2eafd49707ce978ecb6151ceaef5d657cdb3e52fb206e110fcc1cc5b4
- SSDEEP 768:HR41ZSYY14jb7Rf5VpdgpSOrTZU9qZU9rK:x47rY1WQAOrTpYK
- TLSH
  T15F7360126B128464F3590B711962FAE444AAAD3C2AE4F58FF57CBE3A29321D34D7314F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23