174d11e4bf949a545e281e2474249e8ec0f7b031241fccedfdfdfa9d2c28b235

General

Target
Archive.zip
Size 8.5MB
Sample260930-xd9kwazbjd
SHA256 174d11e4bf949a545e281e2474249e8ec0f7b031241fccedfdfdfa9d2c28b235
MD5 5a6ae32acabeb13ad2b8941582a86421
SHA1 8c1511d18857e908e10ff12610c1ab8d899ce4cc
SHA512 29752549613672095b76da2a6cb449f57002383ccddb9b673efb082a451d0925c873d7f05eef6a5f615c71a0d01c908aaa29d9c8fc24c4790902f5bff0ca4ea8
SSDEEP 196608:m94Vx/McdxU21zu+V8q88mlxRIeZTGroTygJjfV4BA+cl8osRyP:a4BRupVZs+TUzgJ54BcPsRyP
TLSH
T19E9633FE7579FE6D9991600E0A40471AF7B64F4226BF2387B727F0C31341A938299D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Archive.zip
- Size 8.5MB
- SHA256 174d11e4bf949a545e281e2474249e8ec0f7b031241fccedfdfdfa9d2c28b235
- MD5 5a6ae32acabeb13ad2b8941582a86421
- SHA1 8c1511d18857e908e10ff12610c1ab8d899ce4cc
- SHA512 29752549613672095b76da2a6cb449f57002383ccddb9b673efb082a451d0925c873d7f05eef6a5f615c71a0d01c908aaa29d9c8fc24c4790902f5bff0ca4ea8
- SSDEEP 196608:m94Vx/McdxU21zu+V8q88mlxRIeZTGroTygJjfV4BA+cl8osRyP:a4BRupVZs+TUzgJ54BcPsRyP
- TLSH
  T19E9633FE7579FE6D9991600E0A40471AF7B64F4226BF2387B727F0C31341A938299D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  encryptor.exe
- Size 5.9MB
- SHA256 dfaf0e2e1c579d5a136e3b83da28d6ecfe9eec95030fe4a9918c779776f51e4e
- MD5 2da9891d978ade2f63782a080b252606
- SHA1 d55ea9133e1a13b66899a4a119996ee0cb86ce0d
- SHA512 4291a57458528d97bf4fbbca93acb41454f8af273dca169c137777205541435503bebd7db1689fd3878a6a05e4ff3ba759e4db9107e9a2baaa6c24340237da20
- SSDEEP 49152:GUmbbbCVIdGSOU0FiUX5EVG60Dd5Pnf4Imug2DVOnX6IxBjlorHFqMY50O8U6IU+:VPF/PvfkuUxBS7Ay2t+st9iOFnKJGv
- TLSH
  T155568E43F25254DDC21BD539C2A67637B33679892131AFBB1EC89F356E22AC48B1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery ransomware spyware stealer
- Drops file in Drivers directory
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  gui.exe
- Size 16.7MB
- SHA256 7a2212d062681504c930c0910e74edd9e5cf35276d83b0d5833beb8a02fcc868
- MD5 69e643f5ab1ac2e5255297106bd13645
- SHA1 f0115bb34581a1130d64d512553ec1656628f17e
- SHA512 b3e8eb10ac2e5cbb76bf93fbe3d28b0681a95aec6b8de332aef4529cddbb50ff1414e7bd4ecbf35a23afacf025cdf5bef66c3209a30d58383eab906f712c998f
- SSDEEP 98304:t0a89VGyNQtr/GFUHwM154Hdw7MTsqbL1JBAG9/XF8bq++sIsiOFTXRH/bvrnkwh:x2V3/FUV154H/jb2M//+HFTXRH/bvrnp
- TLSH
  T1E5079E43F212499DC127D63682B6363BB23677482624AFBB1F885F355F62BC04E1B758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6