fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9

General

Target
encryptor.exe
Size 235KB
Sample260924-wtaaaasxhs
SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
MD5 57b46b4f62bc6e04a42b277005dfece6
SHA1 c0892026e97dab08670aa22f4c8dd8f421d56459
SHA512 d38a7124db18107d6e3d58bef07ee9aec959d812e3caf67415e132efd4cca99db2ab71e4ded84c8b8bbd026766e09ae685c356c63c2dc62f719b2bd1cb1fc1b3
SSDEEP 6144:6t4KndG5MXZnEiO3IEinIYN2GUYVG7xj:iEb3qXN2WVy
TLSH
T195348E19B7A50CFAE5B7C179CD424946DB737C4647A0DBDF07A00A928E13AE09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  encryptor.exe
- Size 235KB
- SHA256 fb95c1329a3b5434636a985775b10095b38113605c754b1069725ee1103057f9
- MD5 57b46b4f62bc6e04a42b277005dfece6
- SHA1 c0892026e97dab08670aa22f4c8dd8f421d56459
- SHA512 d38a7124db18107d6e3d58bef07ee9aec959d812e3caf67415e132efd4cca99db2ab71e4ded84c8b8bbd026766e09ae685c356c63c2dc62f719b2bd1cb1fc1b3
- SSDEEP 6144:6t4KndG5MXZnEiO3IEinIYN2GUYVG7xj:iEb3qXN2WVy
- TLSH
  T195348E19B7A50CFAE5B7C179CD424946DB737C4647A0DBDF07A00A928E13AE09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Renames multiple (1680) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1